A network technician was tasked to respond to a compromised workstation. The technician documented the scene, took the machine offline, and left the PC under a cubicle overnight.
Which of the following steps of incident handling has been incorrectly performed? occurred. A well-prepared organization will have process and procedures that are used when an incident occurs. authorities when required by policy or law. The chain of custody also includes documentation of the scene, preserve all forms of evidence and data when litigation is expected. The preservation of the evidence, data, and details is referred to as legal hold.
A.
Document the scene
B.
Forensics report
C.
Evidence collection
D.
Chain of custody