Which of the following representatives of incident response team takes forensic backups of the systems that are the focus of the incident?

The technical representative possesses the system-level expertise and access required to perform forensic imaging and backups of affected systems using tools such as dd or FTK Imager, ensuring evidence integrity and chain of custody are maintained for the investigation.

The information security representative focuses on policy compliance, risk assessment, and security posture guidance rather than performing hands-on forensic data collection tasks.

The legal representative advises on regulatory obligations, evidence admissibility, and organizational liability but does not perform technical forensic procedures on systems.

The lead investigator coordinates and directs the overall investigation effort and delegates hands-on forensic backup tasks to the technical representative rather than performing them directly.