Which practice is recommended regarding antivirus scanning on a forensic workstation?

• A. Scan suspect hard drive before beginning
• B. Never run a scan on your forensics workstation because it could change your system
• C. Scan during an investigation every five minutes
• D. Scan your forensics workstation before beginning an investigation

Answer: (D)

Ensuring a trusted, known-good environment is essential for forensic work. Running antivirus on the forensics workstation before you begin helps confirm the system is not compromised and cannot introduce malware or alter evidence during analysis. Scanning the suspect drive first can risk modifying data with quarantine actions or other changes; scanning during an investigation every few minutes is excessive and impractical; and avoiding scans on the workstation entirely would leave you blind to threats. By starting with a clean baseline, you protect the integrity of your tools and the evidence you handle throughout the case.