[11.11] When recovering raw data or files from a mobile phone, it is advisable to immediately create a read-only master copy and duplicate it.

Question

BlackTom AI · Accepted Answer

Interpreting this true/false item, we evaluate the best practice when handling data from a mobile device.
Option: True. Creating a read-only master copy (a forensic image) immediately helps preserve the original data in its untouched state, preventing accidental or intentional modification during subsequent analysis. Duplicating that master copy provides additional working datasets for investigators, so original evidence remains pristine while multiple copies can be examined in parallel.
Why this is good practice: employing a write-blocker or write-protect mechanism ensures the device and its storage aren’t altered during acquisition, which is critical for maintaining admissibility in investigations. Having a verified master copy also supports reproducibility and helps satisfy chain-of-custody requirements.
Why this matters for data integrity: raw data can be volatile to changes; even a small modification can affect hash values, metadata, or file contents. Immediate imaging and protection guard against such risks and maintain a clear audit trail.
Edge considerations: in real-world workflows, we also document the acquisition process, log hash values of the master copy, and securely store both the master and duplicates with tamper-evident controls. While it’s tempting to inspect content right away, doing so on the original should be avoided to prevent inadvertent changes.
If one were to disagree, the counterpoint would be that sometimes quick triage or live analysis might seem urgent; however, any initial actions should still be performed on copies or through non-destructive methods to preserve evidence integrity.
In sum, the recommended practice aligns with standard digital forensics principles: acquire a read-only master copy first and then create duplicates for analysis, keeping the original unchanged.

EN.650.667.01.SP25 测验 - 第 1 章

[11.11] When recovering raw data or files from a mobile phone, it is advisable to immediately create a read-only master copy and duplicate it.

View Explanation

Log in for full answers

Similar Questions

[9.2-9.6] Which of the following tasks should be considered when handling an Android device to enable greater access for analysis? (Select all that apply)

[6.7] How can forensic examiners use the Android emulator in relation to adb commands?

[3.8] When connecting an Android device to a workstation, why might write protection prevent the successful acquisition of a device?

[3.5] For an Android, which of the following files are of interest for a forensic examiner?

[1.8] What are the major categories of the mobile forensics process?

[12.5] 下列哪项内容应包含在移动设备法医检查报告中？（选择所有适用的选项。）

[12.4] A report of the forensic examination of a mobile device should include details about the important actions performed by the examiner, results of the acquisition, and any inferences drawn from the results.

More Practical Tools for Students Powered by AI Study Helper

Homework AI Solver

Stylized AI Paper Writer

Plagiarism Checker Assistant

Citation AI Academic Writing Tool

In-Class Translation Assistant

AI Note Generator

AI Quiz Answers

Past Exam Questions from University Test Bank

Smart Practice Assistant

Adaptive Practice

Making Your Study Simpler