Which of the following steps are generally followed in computer forensic examinations?
Each correct answer represents a complete solution. Choose three.
A.
Acquire
B.
Analyze
C.
Authenticate
D.
Encrypt
Explanation:
The following steps are generally followed in computer forensic examinations.
1.Acquire. In this step, the examiner gets an exact duplicate copy of the original data for
investigation. The examiner leaves the original copy intact.
2.Authenticate. In this step, the investigator shows that the data is unchanged and has not been
tampered.
3.Analyze. In this step, the examiner analyzes data carefully. The examiner recovers evidence by
examining hard disk drives, hidden files, swap data, the Internet cache, and the Recycle bin.
Answer option D is incorrect. Encrypt is not a step followed in computer forensic examinations.
“http.//en.wikipedia.org/wiki/Computer_forensics”