In the initial stages of an incident response, Matt, the security administrator, was provided the hard
drives in
QUESTION from the incident manager. Which of the following incident response
procedures would he need to perform in order to begin the analysis? (Select TWO).
A.
Take hashes
B.
Begin the chain of custody paperwork
C.
Take screen shots
D.
Capture the system image
E.
Decompile suspicious files
We came across a cool web page that you could possibly love. Take a appear in case you want.