Question 23: During a digital investigation which activity is MOST closely associated with the acquisition phase? Imaging a hard drive to create an exact byte-for-byte copy for analysis. Searching through electronic records to identify relevant emails for a court case. Determining if cryptographic methods need to be employed to protect data during storage. Reviewing a detailed log of who handled the evidence and when.

Question

Question 23: During a digital investigation which activity is MOST closely associated with the acquisition phase? Imaging a hard drive to create an exact byte-for-byte copy for analysis. Searching through electronic records to identify relevant emails for a court case. Determining if cryptographic methods need to be employed to protect data during storage. Reviewing a detailed log of who handled the evidence and when.

Answer 1

## Brief ExplanationsThe acquisition phase in a digital investigation typically involves creating an exact copy of the digital evidence to ensure that the original source remains unaltered.# AnswerImaging a hard drive to create an exact byte-for-byte copy for analysis.