A technician is conducting a forensics analysis on a computer system. Which step should be taken first?

Question

Quizplus · Accepted Answer

The first step in the forensic analysis of an infected system is to obtain the binary copy of the system.
Key Takeaway: A system cannot be analyzed or searched for evidence using a simple file copy. The investigators need to obtain the binary copy to preserve evidence. This copy must be tamper-proof and must be capable of independent verification.

A Technician Is Conducting a Forensics Analysis on a Computer