Which of the following is the stage in an investigating when forensic images are obtained?

The correct answer is A. Acquisition. Acquisition is the stage where forensic images (bit-for-bit copies) of storage media are captured - this is literally the act of "acquiring" the evidence before any analysis begins. Preservation (B) comes before acquisition and focuses on securing and protecting the original evid

Submitted by rohit_dlh· Mar 6, 2026Security Operations

Question

Options

AAcquisition
BPreservation
CReporting
DE-discovery

How the community answered

(58 responses)

A
88% (51)
B
2% (1)
C
7% (4)
D
3% (2)

Explanation

Acquisition is the stage where forensic images (bit-for-bit copies) of storage media are captured - this is literally the act of "acquiring" the evidence before any analysis begins. Preservation (B) comes before acquisition and focuses on securing and protecting the original evidence from tampering, not copying it. Reporting (C) is the final stage where findings are documented and presented, long after images have already been collected. E-discovery (D) is a legal process for identifying and producing electronically stored information in litigation, not a forensic investigation stage itself.

Memory tip: Think of the order - you preserve the scene, acquire the images, analyze the data, then report findings. "Acquisition = obtaining" - both words relate to getting/receiving something.

Topics

#Digital Forensics#Data Acquisition#Incident Response#Forensic Imaging

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice