Bird
0
0

A forensic analyst accidentally modifies a file timestamp while copying evidence. What is the best way to fix this mistake?

medium📝 Analysis Q14 of 15
Cybersecurity - Digital Forensics
A forensic analyst accidentally modifies a file timestamp while copying evidence. What is the best way to fix this mistake?
ARe-collect the evidence using proper write-blocking tools
BManually change the timestamp back to original
CIgnore it since the file content is unchanged
DDelete the file and use a backup copy
Step-by-Step Solution
Solution:

  1. Step 1: Identify the problem caused by modifying evidence

    Changing timestamps can question evidence integrity in court.

  2. Step 2: Determine the correct corrective action

    Re-collecting with write-blockers ensures no changes happen again.

  3. Final Answer:

    Re-collect the evidence using proper write-blocking tools -> Option A

  4. Quick Check:

    Use write-blockers to avoid evidence changes [OK]
Quick Trick: Re-collect evidence properly if altered [OK]
Common Mistakes:
MISTAKES
  • Ignoring timestamp changes
  • Trying to manually fix timestamps
  • Deleting files without proper backup

Want More Practice?

15+ quiz questions · All difficulty levels · Free

Free Signup - Practice All Questions
More Cybersecurity Quizzes
Advanced Threat Protection - Endpoint Detection and Response (EDR) - Quiz 10hard Advanced Threat Protection - Malware analysis basics - Quiz 3easy Compliance and Governance - SOC 2 compliance - Quiz 14medium Compliance and Governance - Risk assessment methodologies - Quiz 9hard Emerging Security Topics - Supply chain security - Quiz 11easy Incident Response - Containment strategies - Quiz 4medium Security Architecture and Design - Network segmentation - Quiz 10hard Security Architecture and Design - Defense in depth strategy - Quiz 7medium Security Architecture and Design - Secure SDLC practices - Quiz 5medium Security Architecture and Design - Threat modeling (STRIDE, DREAD) - Quiz 2easy