PrepAway - Latest Free Exam Questions & Answers

Which of the following forensic procedures is involved?

The security manager received a report that an employee was involved in illegal activity and has saved data to
a workstation’s hard drive. During the investigation, local law enforcement’s criminal division confiscates the
hard drive as evidence. Which of the following forensic procedures is involved?

PrepAway - Latest Free Exam Questions & Answers

A.
Chain of custody

B.
System image

C.
Take hashes

D.
Order of volatility

Explanation:
Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you
begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen
it, and where it has been.


Leave a Reply