Are you studying for the CISSP certification?
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
A forensic investigator performed a file copy to another device. The original is now cataloged and in storage with a verified chain of custody. He is analyzing and working on the copied data and complying with established chain of custody procedures the investigator has found incriminating evidence in the device's slack space. A judge is reviewing his findings and determines the evidence presented to be inadmissible. Please identify a reason for the judges inadmissible ruling
the chain of custody was broken by not working on the original device
The cloned copy was lost
the investigator is working directly on the copied device
The investigator performed a file copy
The investigator should have performed a bit level copy not a file copy. Bit level copies are needed to preserve slack space A file level copy will not capture slack space Chain of custody procedures were followed. The investigator should preserve the original device and work on the copy
'it was Tuesday' as a potential answer? Cmon, skillset. ISC2 would not have answers like this. [edit: this is misleading question/answer.]
Train with Skillset and pass your certification exam. Faster. Guaranteed.
Study thousands of practice questions that organized by skills and ranked by difficulty.
Create a tailored training plan based on the knowledge you already possess.
Know when you’re ready for the high-stakes exam. Have the confidence that you will pass on your first attempt.