During an incident involving the company main database, a team of forensics experts is hired to respond to the
breach. The team is in charge of collecting forensics evidence from the company’s database server. Which of
the following is the correct order in which the forensics team should engage?
A.
Notify senior management, secure the scene, capture volatile storage, capture non-volatile storage,
implement chain of custody, and analyze original media.
B.
Take inventory, secure the scene, capture RAM, capture had drive, implement chain of custody, document,
and analyze the data.
C.
Implement chain of custody, take inventory, secure the scene, capture volatile and non-volatile storage, and
document the findings.
D.
Secure the scene, take inventory, capture volatile storage, capture non-volatile storage, document, and
implement chain of custody.