Mysystem.org IT ExamsCISSP-Question-461 2017-04-02
Question: Great care must be taken to capture clues from a computer or device during a forensics exercise. Which of the following does not correctly describe the efforts that should be taken to protect an image?
A. The original image should be hashed with MD5 and/or SHA-256.
B. Two time-stamped images should be created.
C. New media should be properly purged before images are created on them.
Answer ==> D. Some systems must be imaged while they are running.