Which of the following is a best practice when a mistake is made during a forensics examination?
The examiner should verify the tools before, during, and after an examination.
The examiner should attempt to hide the mistake during cross-examination.
The examiner should document the mistake and workaround the problem.
The examiner should disclose the mistake and assess another area of the disc.
Every step in an incident response should be documented, including every action taken by end users and the