Exam SY0-701 topic 1 question 554 discussion

A. Acquisition Explanation: ✔ Acquisition is the stage in a forensic investigation when forensic images (bit-for-bit copies) of digital evidence are created. ✔ The goal is to capture the original state of the data while ensuring that it is not altered during the process. ✔ Forensic imaging is critical to ensure data integrity and maintain chain of custody for legal purposes. Why not the other options? B. Preservation – While preservation involves protecting the evidence from alteration or damage, the actual act of copying the data occurs during acquisition. C. Reporting – Involves documenting the findings and actions taken, not the process of obtaining digital evidence. D. E-discovery – Refers to the process of identifying, collecting, and reviewing electronic data for legal purposes, often related to litigation, not specifically about obtaining forensic images.