Company XYZ has experienced a breach and has requested an internal investigation be conducted by the IT Department. Which of the following represents the correct order of the investigation process?

The correct answer is B. Identification, Preservation, Collection, Examination, Analysis, Presentation. The correct digital forensics order is Identification → Preservation → Collection → Examination → Analysis → Presentation. First, you Identify what evidence exists and where it resides. Then you Preserve it immediately - this is critical because volatile or fragile evidence…

Enterprise Security

Question

Options

ACollection, Identification, Preservation, Examination, Analysis, Presentation.
BIdentification, Preservation, Collection, Examination, Analysis, Presentation.
CCollection, Preservation, Examination, Identification, Analysis, Presentation.
DIdentification, Examination, Preservation, Collection, Analysis, Presentation.

How the community answered

(42 responses)

B
93% (39)
C
5% (2)
D
2% (1)

Explanation

The correct digital forensics order is Identification → Preservation → Collection → Examination → Analysis → Presentation. First, you Identify what evidence exists and where it resides. Then you Preserve it immediately - this is critical because volatile or fragile evidence (RAM, logs) can be lost or altered; preservation includes write-blocking drives and creating forensic hashes. Collection comes after preservation to ensure the integrity of what you gather. Examination involves processing and filtering the collected data. Analysis draws conclusions and builds a timeline. Presentation delivers findings to stakeholders or courts. Collecting before preserving risks evidence contamination, which is why options A, C, and D are incorrect.

Topics

#digital forensics#incident investigation#evidence handling#chain of custody

Community Discussion

No community discussion yet for this question.

Full CAS-001 Practice