Which statement reflects the policy on attempting to restore or recover information from a system containing electronic data during a forensic investigation?

• A. Any staff member can perform restoration with permission.
• B. Only qualified computer forensics personnel should attempt restoration.
• C. Restoration attempts are discouraged unless the data is non-sensitive.
• D. Restoration is always mandatory before analysis.

Answer: (B)

Preserving the integrity of electronic evidence requires that restoration or recovery actions be performed by trained, authorized personnel. Only qualified computer forensics personnel should attempt restoration to ensure proper handling, use of appropriate tools, and thorough documentation, which helps maintain the chain of custody and prevents inadvertent data alteration that could compromise admissibility.

This is why the correct choice is that restoration should be limited to qualified forensics staff. Allowing any staff member with casual permission could lead to inconsistent methods and potential contamination. The policy isn’t about data sensitivity dictating who can act; it’s about ensuring that sensitive operations follow vetted forensic procedures. And restoration isn’t universally mandatory before analysis; the workflow emphasizes preserving and imaging first and applying restoration actions only when appropriately authorized and necessary.