Joe a computer forensic technician responds to an active compromise of a database server. Joe first collects information in memory, then collects network traffic and finally conducts an image of the hard drive. Which of the following procedures did Joe follow?

Question

Quizplus · Accepted Answer

Joe followed the order of volatility, which prioritizes collecting the most volatile data first, such as information in memory, followed by less volatile data like network traffic, and finally the least volatile data, such as the hard drive image.

Joe a Computer Forensic Technician Responds to an Active Compromise