220-1102 Question 736
Single answerCopy of drive (data integrity and preservation)A small law office asks a technician to preserve data from an employee's failing laptop drive before the machine is sent for further investigation. The drive is still readable but makes intermittent clicking sounds, and the office wants the most complete copy possible without altering the original evidence. Which action should the technician take FIRST to best preserve data integrity?
- A
Create a sector-by-sector image of the failing drive to a known-good destination drive and perform recovery work on the image copy
- B
Boot the laptop normally and copy the employee's profile folders to a USB drive using File Explorer
- C
Run CHKDSK with repair switches on the original drive to fix file system errors before copying data
- D
Defragment the original drive so files are contiguous and easier to copy to another disk
Show answer and explanation
Correct answer: A
Explanation
When handling a failing drive and trying to preserve data integrity, best practice is to make an image or clone of the drive first and then work from the copy. This reduces the risk of further damaging the source and helps preserve the original state of the data. In evidence-sensitive situations, technicians avoid actions that write to the original disk, such as file system repairs or optimization tasks. Industry best practices in incident response and digital forensics emphasize acquiring a forensic or sector-level copy before analysis whenever possible, and general vendor guidance for failing storage devices also recommends minimizing use of the original drive and copying data to a healthy target as soon as possible.
- A. Correct.
Correct. A sector-by-sector image, often called a bit-level or forensic-style image, is the best first step when a drive is failing but still readable and the goal is preservation and integrity. It captures the drive contents as completely as possible, including file system structures and potentially recoverable data, while minimizing changes to the source. Recovery and analysis should then be performed against the copy rather than the original drive.
- B. Incorrect.
Incorrect. Copying user folders with File Explorer may preserve some obvious user data, but it does not create a complete drive copy and can miss hidden files, deleted data, metadata, permissions, and damaged but recoverable sectors. It also requires normal OS access, which may trigger additional reads and writes that stress the failing drive.
- C. Incorrect.
Incorrect. Running CHKDSK with repair options modifies the file system on the original disk. That is the opposite of preservation when data integrity and evidence handling matter. While CHKDSK can be useful in some troubleshooting cases, it should not be the first action on a failing drive when the priority is to preserve original data unchanged.
- D. Incorrect.
Incorrect. Defragmentation increases disk activity and writes extensively to the original drive, which can worsen failure and alter data significantly. It is not a preservation technique and is especially inappropriate for a drive that is mechanically failing.