During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering. Which of the following should the junior analyst have followed?
A. Continuity of operations
B. Chain of custody
C. Order of volatility
D. Data recovery
During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removin
-
answerhappygod
- Site Admin
- Posts: 899604
- Joined: Mon Aug 02, 2021 8:13 am
During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removin
Join a community of subject matter experts. Register for FREE to view solutions, replies, and use search function. Request answer by replying!