A technician, Joe, has been told that one of the workers at his company has been using a company laptop for illicit activity. The IT manager assigned Joe the task of retrieving the laptop and…

The correct answer is B. Gathering evidence. Joe's act of physically retrieving the laptop constitutes gathering evidence - collecting the item that may contain proof of illicit activity. Chain of custody (A) refers to the documented trail showing who has handled evidence after it is collected. Device preservation (C)…

Hardware and network troubleshooting

Question

A technician, Joe, has been told that one of the workers at his company has been using a company laptop for illicit activity. The IT manager assigned Joe the task of retrieving the laptop and bringing it back to the repair center. Which of the following has Joe performed?

Options

AMaintain chain of custody
BGathering evidence
CDevice preservation
DUse of documentation

How the community answered

(27 responses)

B
89% (24)
C
7% (2)
D
4% (1)

Explanation

Joe's act of physically retrieving the laptop constitutes gathering evidence - collecting the item that may contain proof of illicit activity. Chain of custody (A) refers to the documented trail showing who has handled evidence after it is collected. Device preservation (C) means protecting the device from changes (e.g., write-blocking). Documentation (D) is the record-keeping process. Since Joe was assigned to retrieve the laptop and bring it back, the act itself is evidence gathering.

Topics

#evidence gathering#forensics#chain of custody#incident response

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice