Study. uk . com
  1. Home
  2. All questions
  3. Question 506

CompTIA Security+ study material · question 506 of 611

Why is forensic examination performed on a copy rather than the original media?

  1. Original media cannot be hashed
  2. Copies are admissible where originals are not
  3. The original stays unchanged and the copy can be re-examined
  4. Copies process faster than original drives
Show the answer

Answer: C. The original stays unchanged and the copy can be re-examined

Working on the original risks altering it, which would undermine every conclusion drawn from it.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 4.2.1 Copying Files from Media

Challenge yourself on this topic → Study as cards