A university forensics lab stores the original laptop drive on a shelf and allows the analyst to work only from a forensic copy. Which practice does that shelf rule follow?
Select an answer to reveal the explanation.
Short Explanation
Leave the sealed exhibit in the locker and study a photocopy. You are preserving the original drive by working from the copy. The trap is calling that shelf rule memory collection, a SOC clock, or phone enrollment.
Full Explanation
The right selection is "Preservation of the original, with the seized drive kept intact while the analyst works from a copy". NIST SP 800-86 treats preservation as keeping the original intact and doing the examination on a copy, so later reviewers can still see the unchanged drive. The statement "Volatile collection of live memory while the university laptop is still powered on in the lab" is a memory capture from a running system, and the scenario is a drive sitting on a shelf. The statement "A SOC timing metric that measures how quickly the university lab finished this laptop case" is a clock such as time to contain, and storing a drive is not a measurement of speed. The statement "Mobile device management that enrolls a phone and pushes a configuration to that phone" enrolls and configures phones, and a seized laptop drive is not a phone-management action. Exam caveat: preservation also includes a record of who handles the original, and the question here is the decision to leave that drive untouched. Operational check: confirm the evidence log shows the shelf location of the original and that tools were aimed at the working copy.