In forensic reporting, which statement best describes an ISO image captured from optical media?

Unlock all questions

This demo includes only 20 questions. Upgrade to access hundreds of questions, flashcards, exam simulations, and disable ads.

Full question bankExam simulationsFlashcards
From $24.99Unlock all

Prepare for the Computer Hacking Forensic Investigator v11 exam. Study with flashcards and multiple choice questions. Each question includes hints and explanations. Get exam-ready efficiently!

Multiple Choice

In forensic reporting, which statement best describes an ISO image captured from optical media?

Explanation:
An ISO image is a sector-by-sector copy of optical media, preserving every byte and the exact layout of the disc, including unused sectors and filesystem metadata. This faithful replica lets you mount or analyze the disc contents as they existed on the original media, and you can verify integrity with a hash to ensure it hasn’t changed. It’s not a memory dump (that would capture volatile RAM), not a decrypted database export (which extracts data from a database), and not a network packet trace (which records network traffic).

An ISO image is a sector-by-sector copy of optical media, preserving every byte and the exact layout of the disc, including unused sectors and filesystem metadata. This faithful replica lets you mount or analyze the disc contents as they existed on the original media, and you can verify integrity with a hash to ensure it hasn’t changed. It’s not a memory dump (that would capture volatile RAM), not a decrypted database export (which extracts data from a database), and not a network packet trace (which records network traffic).

More Multiple Choice Questions
Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy