When creating a forensic image of a hard drive, which of the following should be the FIRST step?
A.
Identify a recognized forensics software tool to create the image.
B.
Establish a chain of custody log.
C.
Connect the hard drive to a write blocker.
D.
Generate a cryptographic hash of the hard drive contents.
so what is the answer? I think B.
0
0
It should be D. Ensure data integrity.
0
0