A corporate laptop is discovered to have been compromised. The incident has been contained, and the laptop is in the possession of the incident response team. Which of the following should be done NEX

Question

Options

• AWipe the system
• BPerform a root cause analysis
• CCreate a duplicate image
• DInitiate system recovery

• A
  16% (6)
• B
  5% (2)
• C
  76% (29)
• D
  3% (1)

Explanation

Creating a forensic duplicate image (option C) must happen before anything else because it preserves the exact state of the compromised system - every file, log, and artifact - allowing investigators to analyze evidence without risking contamination or loss. This follows the core forensics principle: collect before you act.

Why the distractors are wrong:

• A (Wipe the system): Destroying the drive destroys the evidence. You can't determine how the breach happened if the data is gone.
• B (Root cause analysis): This is the right goal, but you perform it on the image, not on the live compromised system - doing it beforehand risks altering evidence.
• D (System recovery): Recovery is a remediation step that comes after investigation is complete, not before you've even preserved evidence.

Memory tip: Think of IR like a crime scene - police photograph and document everything before cleaning up. In digital forensics, the image is the photograph. The order is always: Contain → Image → Investigate → Recover → Lessons Learned.

No community discussion yet for this question.