An incident responder is preparing to acquire images and files from a workstation that has been compromised. The workstation is still powered on and running. Which of the following should be acquired LAST?

Question

Quizplus · Accepted Answer

Application files on the hard disk should be acquired last because they are less volatile compared to processor cache, running processes, and swap space, which can change or be lost if the system is powered down or altered.

An Incident Responder Is Preparing to Acquire Images and Files