Question: Great care must be taken to capture clues from a computer or device during a forensics exercise. Which of the following does not correctly describe the efforts that should be taken to protect an image?
A. The original image should be hashed with MD5 and/or SHA-256.
B. Two time-stamped images should be created.
C. New media should be properly purged before images are created on them.
D. Some systems must be imaged while they are running.

Download pdf (with explanations) edition of this exam.