John, a forensic officer, was working on a criminal case. He employed imaging software to create a copy of data from the suspect device on a storage medium for further investigation. For developing an image of the original data, John used a software application that does not allow an unauthorized user to alter the image content on storage media, thereby retaining an unaltered image copy. Identify the data acquisition step performed by John in the above scenario.

John, a forensic officer, was working on a criminal case. He employed imaging software to create a copy of data from the suspect device on a storage medium for further investigation. For developing an image of the original data, John used a software application that does not allow an unauthorized user to alter the image content on storage media, thereby retaining an unaltered image copy. Identify the data acquisition step performed by John in the above scenario.
A . Validated data acquisition
B . Planned for contingency
C . Sanitized the target media
D . Enabled write protection on the evidence media

View Answer

Answer: D

Explanation:

In digital forensics, write protection is a crucial step during data acquisition to ensure that the data being imaged cannot be altered during the process. This is essential to maintain the integrity of the evidence. John’s use of imaging software that prevents unauthorized alteration indicates that he enabled write protection, which is a standard practice to safeguard the original data on storage media.

Reference: The EC-Council highlights the importance of data acquisition and the necessity of write protection to preserve data integrity in digital forensic investigations12.