Which action best maintains evidence integrity when collecting data?

• A. Create a backup image of the original evidence
• B. Modify evidence to fit an expected narrative
• C. Copy data onto new devices
• D. Postpone collection until later

Answer: (A)

Creating a forensic backup image of the original evidence is the best way to maintain integrity because it preserves the exact bit-for-bit state of the data while keeping the original untouched. By imaging with a write blocker, you prevent any accidental or intentional changes to the source during collection. Verifying the image with cryptographic hashes (like SHA-256) ensures the copy is an exact replica of the original, providing a trustworthy basis for analysis and for later presentation in court. This approach supports a solid chain of custody and allows multiple analyses without repeatedly touching the original.

Modifying evidence to fit a narrative corrupts integrity and is not acceptable. Copying data onto new devices can be part of the process, but without proper imaging, write-blocking, and hash verification, it risks altering data. Postponing collection loses the opportunity to preserve volatile or time-sensitive information and can allow data to be altered or destroyed.