212-89 · Question #146
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination…
The correct answer is C. Examination. Examination (C) is the correct answer because this phase specifically involves processing large amounts of collected data through a combination of automated tools and manual review to extract relevant, usable information while preserving its integrity - exactly as described in…
Question
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:
Options
- AAnalysis
- BPreparation
- CExamination
- DCollection
How the community answered
(32 responses)- A3% (1)
- C94% (30)
- D3% (1)
Explanation
Examination (C) is the correct answer because this phase specifically involves processing large amounts of collected data through a combination of automated tools and manual review to extract relevant, usable information while preserving its integrity - exactly as described in the scenario.
Why the distractors are wrong:
- A. Analysis comes after examination; it involves interpreting and drawing conclusions from already-processed data, not the initial processing itself.
- B. Preparation is a pre-investigation phase focused on setting up tools, obtaining authorization, and establishing procedures - not processing evidence.
- D. Collection is about acquiring and preserving raw data from sources, not processing it.
Memory tip: Think of the forensic workflow as a pipeline - Collect → Examine → Analyze - and remember that Examination is the "lab work" step where raw evidence gets processed and sifted, bridging the gap between gathering data and understanding it.
Topics
Community Discussion
No community discussion yet for this question.