What invalidates digital evidence authenticity?
Short answer
A Installing forensic software on the original drive modifies data and invalidates authenticity.
Question
Key Takeaways
This tests the principle of preserving original evidence integrity, where the trap is confusing live acquisition with direct modification of the source media.
Modifying the original evidence drive by installing software destroys data integrity. The community agrees that working on a copy is essential to maintain authenticity.
Common mistake: Choosing Option D is common because live acquisition is risky, but installing software on the original drive (Option A) is a direct violation of integrity.
Expert Analysis
Why the Answer Is Correct
Installing forensic software on the original drive writes data to the media. This changes file access times, modifies the file system, and potentially overwrites unallocated space. These changes alter the state of the evidence, making it impossible to prove the data is in its original state. Therefore, authenticity is invalidated.
Why the Other Options Are Wrong
Option B is incorrect because analyzing a copy is the standard best practice to preserve the original. Option C is incorrect because write blockers are tools specifically designed to prevent modification and ensure authenticity. Option D is incorrect because live acquisition is a valid procedure for capturing volatile data like RAM, provided it is documented, and does not inherently invalidate authenticity like altering the drive does.
Community Comment Notes
Comment [1] correctly identifies that installing software modifies data and compromises integrity, recommending bit-for-bit copies. Comment [3] confirms this view. Comment [2] suggests Option D but contains confusing logic regarding copies; however, the majority view and standard forensic principles strongly support Option A.
Official Reference
https://www.nist.gov/publications/guide-integrating-forensic-techniques-incident-response
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always look for actions that modify the original evidence. If an option involves writing to the source drive, it is almost certainly the answer for invalidating evidence.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
1e71ed5 👍 3Option A, where the investigator installed forensic software on the original drive that contained the evidence, could also impact the authenticity of the evidence. Installing software on the original drive might modify or alter the data, thus compromising its integrity. Forensic best practices recommend making a bit-for-bit copy of the drive and performing analysis on the copy to avoid altering the original evidence. In summary, both options A and D can affect the authenticity of digital evidence, but D is generally considered more critical because it directly involves potential changes to the original data while it is being collected.
-
Sibsankar 👍 1The right answer will be D due to the inherent risk of modifications and potential compromises to the chain of custody, collecting evidence from a copy of the disk data presents the greatest concern regarding its authenticity in a forensic investigation. It's important to note that the validity of digital evidence ultimately depends on a holistic assessment of all collection, handling, and analysis procedures. Consulting with experts and following established forensic methodologies are crucial for ensuring the admissibility and reliability of digital evidence.
-
marc4354345 👍 4A is correct.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →