An online gaming company was impacted by a ransomware attack. An employee opened an attachment that was received via an SMS attack on a company-issue firewall. Which following actions would help durin

Resetting the phone to factory settings would erase all forensic evidence, making it impossible to analyze the compromise.

Rebooting the phone would cause volatile memory to be lost and alter timestamps, while installing updates would change the system state, both detrimental to forensic integrity.

Documenting the chain of custody is essential for any forensic investigation to maintain the integrity and admissibility of evidence by tracking its handling and possession from collection to presentation.

Uninstalling programs would modify the device's state and remove potential evidence related to the ransomware, hindering the forensic analysis.

Performing a memory dump (or physical acquisition) of the mobile device captures volatile data, which includes running processes, open files, network connections, and potentially encryption keys, all critical for understanding the state of the device at the time of compromise.

Blowing the eFuse is a hardware modification that permanently disables specific security features, often making it impossible to boot or access the device, thus destroying it for forensic purposes.