CompTIA
SY0-501 · Question #463
A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take the chain of custody?
Sign in or unlock SY0-501 to reveal the answer and full explanation for question #463. The question stem and answer options stay visible for context.
Submitted by carter_n· Mar 4, 2026Security operations
Question
A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take the chain of custody?
Options
- AMake a forensic copy
- BCreate a hash of the hard rive
- CRecover the hard drive data
- DUpdate the evidence log
Unlock SY0-501 to see the answer
You've previewed enough free SY0-501 questions. Unlock SY0-501 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#digital forensics#chain of custody#evidence handling#incident documentation