Which practice is recommended for all raw acquisitions at the time of analysis?

• A. Separate manual validation is recommended.
• B. Validation should be automated only.
• C. No validation is required.
• D. Validation should be outsourced.

Answer: (A)

Validating raw acquisitions at analysis time ensures the copy is complete and unaltered, preserving evidentiary value. Automated hash checks confirm bit-for-bit integrity, but having a separate manual validation provides an independent, human review that catches issues automated checks might miss and documents the process for defensibility. This extra layer reduces the risk of unnoticed corruption, tool misconfigurations, or logging errors, and it strengthens the chain of custody by showing that a second party reviewed the results. While automation is essential, pairing it with a separate manual validation is the most robust approach for trustworthy forensic analysis.