The first step in acquiring computer evidence is the establishment of ____ procedures.

Question

Quizplus · Accepted Answer

Search and seizure procedures must be established to ensure that evidence obtained from computer systems is admissible in court. These procedures must comply with legal and ethical standards, and involve preserving the chain of custody for any evidence collected. After-action, incidence response, and disaster recovery procedures are related to managing the aftermath of a security incident or disaster, and are not directly related to the acquisition of computer evidence.

The First Step in Acquiring Computer Evidence Is the Establishment