Joe, a computer forensic technician, responds to an active compromise of a database server. Joe first collects
information in memory, then collects network traffic and finally conducts an image of the hard drive. Which of
the following procedures did Joe follow?
A.
Order of volatility
B.
Chain of custody
C.
Recovery procedure
D.
Incident isolation