Lab 1-1: Understanding the Digital Forensics Profession and Investigation

What type of forensic copy should be conducted on the original media?

Bit-stream

What is the term for tracking evidence in an investigation?

Chain of custody

Of the following choices, which would permanently remove data from media so that it is unrecoverable?

Data is accessible until it is overwritten by other content to the same physical location

What Amendment to the U.S. Constitution provides protection against unlawful searches and seizures?

Fourth Amendment

What is the first rule of digital forensics and subsequent analysis of evidence?

Preserve the original evidence, and analyse a copy only