First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for coll

The correct answer is C. Forensic laboratory staff. In incident response, roles are divided among three main groups: (1) System administrators/IT staff, who handle initial technical triage and system stabilization; (2) Local managers or non-forensic staff, who coordinate logistics and communications; and (3) Forensic laboratory st

Submitted by kevin_r· Apr 18, 2026Computer Forensics Investigation Process

Question

First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for collecting, preserving, and packaging electronic evidence?

Options

ASystem administrators
BLocal managers or other non-forensic staff
CForensic laboratory staff
DLawyers

How the community answered

(46 responses)

A
4% (2)
C
93% (43)
D
2% (1)

Explanation

In incident response, roles are divided among three main groups: (1) System administrators/IT staff, who handle initial technical triage and system stabilization; (2) Local managers or non-forensic staff, who coordinate logistics and communications; and (3) Forensic laboratory staff, who are specifically trained and responsible for the proper collection, preservation, documentation, and packaging of electronic evidence. Proper forensic handling is critical to maintaining evidence integrity and chain of custody for legal proceedings. System admins (A) may inadvertently contaminate evidence if they attempt collection without forensic training.

Topics

#Incident Response#Evidence Collection#Evidence Preservation#Digital Forensics Roles

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice