Which of the following practices should the prosecutor’s forensics team have used to ensure the suspect’s data would be admissible as evidence?

During a criminal investigation, the prosecutor submitted the original hard drive from the suspect’s computer as evidence. The defense objected during the trial proceedings, and the evidence was rejected .

Which of the following practices should the prosecutor’s forensics team have used to ensure the suspect’s data would be admissible as evidence? (Select TWO.)
A . Follow chain of custody best practices
B . Create an identical image of the original hard drive, store the original securely, and then perform forensics only on the imaged drive.
C . Use forensics software on the original hard drive and present generated reports as evidence
D . Create a tape backup of the original hard drive and present the backup as evidence
E . Create an exact image of the original hard drive for forensics purposes, and then place the original back in service

View Answer

Answer: A,B