Which of the following steps are generally followed in computer forensic examinations? Each correct answer represents a complete solution. Choose three.

Encryption is a data protection technique, not a step in the forensic examination process - applying encryption to evidence would alter it and compromise forensic integrity.

Acquisition is the first critical forensic step where evidence is collected using forensically sound methods to preserve its original state and maintain chain of custody.

Authentication verifies the integrity of collected evidence, typically using hash values (MD5, SHA-256) to confirm the copy is identical to the original and has not been altered.

Analysis involves systematically examining the authenticated evidence using forensic tools to extract relevant artifacts, timelines, and findings that support the investigation.