Which of the following steps are generally followed in computer forensic examinations? Each correct answer represents a complete solution. Choose three.

The correct answer is A. Acquire B. Analyze C. Authenticate. The standard computer forensic examination process includes three core steps: (A) Acquire - creating a forensically sound bit-for-bit copy (image) of the original evidence while preserving its integrity; (B) Analyze - examining the acquired image using forensic tools to…

Security Operations Management

Question

Options

AAcquire
BAnalyze
CAuthenticate
DEncrypt

How the community answered

(39 responses)

A
87% (34)
D
13% (5)

Explanation

The standard computer forensic examination process includes three core steps: (A) Acquire - creating a forensically sound bit-for-bit copy (image) of the original evidence while preserving its integrity; (B) Analyze - examining the acquired image using forensic tools to identify, extract, and interpret relevant data; and (C) Authenticate - verifying the integrity of the evidence throughout the process, typically using hash values (MD5, SHA-256) to confirm that the copy matches the original and has not been altered. Encryption (D) is a data protection technique, not a forensic examination step - in fact, encryption on a target device can impede forensic analysis rather than be part of the examination workflow.

Topics

#Computer Forensics#Forensic Process#Evidence Handling#Incident Response

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSMP Practice