CISSP All Domains Practice test 12

Digital forensics: The evidence we collect must be accurate, complete, authentic, convincing, admissible. To ensure the disk is not written to and inadmissible, we can use a write blocker. For instance, a Tableau write blocker. Everything is documented. Chain of custody: who had it when? What was done? When did they do it? Pull the original, put it in write protected machine, we make a hash. We only do examinations and analysis on bit level copies. We confirm they have the same hash as the original before and after examination.