Forensic analysis should always be conducted on a copy of the original data

Forensic analysis should always be conducted on a copy of the original data. Which two (2) types of copying are appropriate for getting data from a laptop acquired from a terminated employee, if you suspect he has deleted incriminating files? (Select 2)

1 point

A disk-to-disk backup.

A logical backup.

A disk-to-file backup.

An incremental backup.

The correct answer and explanation is :

Correct Answers:

✅ A disk-to-disk backup
✅ A disk-to-file backup

Explanation (300 words):

In digital forensics, maintaining the integrity and authenticity of data is critical. The process begins with creating a forensic copy—or image—of the original media to ensure the evidence remains unaltered. This is especially important in investigations involving potentially deleted or hidden files, such as when an employee is terminated and suspected of malicious activity.

Disk-to-disk and disk-to-file backups are the most appropriate methods in this scenario.

1. Disk-to-disk backup involves making an exact, bit-by-bit copy of the original storage device (like a laptop hard drive) onto another physical disk. This type of backup ensures every sector, including those marked as deleted or unallocated, is preserved. It is useful in forensic investigations because deleted files often leave residual data in these areas, which can be recovered using forensic tools.
2. Disk-to-file backup also captures a bit-by-bit image of the entire disk, but stores it as a single file (often in formats like E01 or DD). This file can then be analyzed using forensic software like FTK or EnCase without touching the original disk. It allows investigators to extract and examine deleted files, hidden partitions, and metadata while maintaining a verifiable chain of custody.

In contrast:

• Logical backups only capture active files and folders that are visible to the file system, excluding deleted files and unallocated space. Hence, they are not suitable for forensic analysis where deleted or hidden data is crucial.
• Incremental backups only store changes since the last backup. They do not preserve a full snapshot of the disk and miss deleted or unallocated data, making them inadequate for forensic purposes.

Therefore, disk-to-disk and disk-to-file backups are the correct forensic methods to preserve potential evidence and enable comprehensive analysis.