GCFA · Question #60
Which of the following is the correct order of digital investigations Standard Operating Procedure(SOP)?
The correct answer is D. Request for service, initial analysis, data collection, data analysis, data reporting. The correct digital forensics SOP begins with a formal service request, proceeds through scoping and evidence acquisition, and concludes with analysis before reporting.
Question
Which of the following is the correct order of digital investigations Standard Operating Procedure(SOP)?
Options
- AInitial analysis, request for service, data collection, data analysis, data reporting
- BInitial analysis, request for service, data collection, data reporting, data analysis
- CRequest for service, initial analysis, data collection, data reporting, data analysis
- DRequest for service, initial analysis, data collection, data analysis, data reporting
How the community answered
(26 responses)- A12% (3)
- B4% (1)
- C4% (1)
- D81% (21)
Why each option
The correct digital forensics SOP begins with a formal service request, proceeds through scoping and evidence acquisition, and concludes with analysis before reporting.
This option incorrectly places initial analysis before the formal request for service and transposes data analysis and data reporting, which is procedurally invalid since findings cannot be reported before analysis is complete.
This option also places initial analysis before the service request and puts data reporting before data analysis, which is illogical because a report cannot be generated prior to analyzing the collected evidence.
This option correctly sequences the first three steps but then places data reporting before data analysis, reversing the final two phases and producing findings before the evidence has been examined.
The correct SOP sequence is: Request for service (formally initiating and authorizing the investigation), initial analysis (scoping and planning the approach), data collection (acquiring and preserving evidence with chain of custody), data analysis (examining and interpreting collected evidence), and data reporting (documenting and presenting findings) - this order ensures evidentiary integrity and produces a defensible forensic process.
Concept tested: Digital forensics investigation SOP sequence
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
Topics
Community Discussion
No community discussion yet for this question.