Question

why should a digital forensics examiner use a wiping tool on a destination drive before conducting a forensics acquisition?
a. wiping the destination drive allows for greater performance of the drive.
b. wiping the destination drive increases the accuracy of data being written to the drive.
c. wiping the destination drive is required to decommission the drive to prepare it for resale.
d. wiping the destination drive is recommended to ensure that no previous data is stored on that drive that could be comingled with new evidence.

Explanation:

Digital forensics requires the integrity of acquired evidence. Wiping the destination drive removes any existing data, preventing it from mixing with the new forensic evidence, which is critical for maintaining the validity and admissibility of the evidence. The other options are incorrect: wiping does not improve drive performance or data writing accuracy, and this step is not for decommissioning/resale.

Answer:

d. Wiping the destination drive is recommended to ensure that no previous data is stored on that drive that could be comingled with new evidence.