A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?
A security analyst must preserve a system hard drive that was involved in a litigation request. Which of the following is the best method to ensure the data on the device is not modified?
To ensure the data on the device is not modified, the best method is to generate a hash value and make a backup image. Generating a hash value allows the security analyst to check the integrity of the data, ensuring that it has not been altered. Creating a backup image preserves the entire state of the device, allowing for future examination without risking data modification on the original drive.
A) Generate a hash Better option than B since a hash will help preserve integrity by determining if any changes have been made. Additionally, a backup image provides availability in the event the drive fails or needs to be restored.
Correct It seems to be the most logical answer
1, Generate a hash