In the case where digital investigators dealing with distributed systems need to collect data from remote sites, the following procedure is recommended:
A) Notify personnel at the remote sites to leave everything as is, and arrange for travel to the remote locations
B) Notify personnel at the remote sites to shut down all systems and send the hard drives to the forensic lab
C) Utilize remote forensics tools to acquire data from the remote sites' RAM as well as the hard drives
D) None of the above

Question

Quizplus · Accepted Answer

Utilizing remote forensics tools allows investigators to efficiently collect necessary data without the need for physical presence, which is crucial for preserving the integrity and timeliness of evidence in distributed systems.

In the Case Where Digital Investigators Dealing with Distributed Systems