If you suspect computer discovery material has been deleted or altered, what should you try to acquire?
A) hard copies of files
B) hard drive image
C) copies of files on a removable disk
D) the file allocation table

Question

Quizplus · Accepted Answer

The best choice would be to acquire a hard drive image as it captures the exact state of the computer at the time it was imaged, including any deleted or altered files. Hard copies of files may not show any evidence of deletion or alteration, copies on a removable disk could also be altered, and the file allocation table may not capture all changes made to the files.

If You Suspect Computer Discovery Material Has Been Deleted or Altered