Bird
0
0

Which of the following is the correct first step when collecting digital evidence in forensics?

easy📝 Factual Q12 of 15
Cybersecurity - Digital Forensics
Which of the following is the correct first step when collecting digital evidence in forensics?
ADocument the scene and evidence before touching anything
BTurn off the device immediately to prevent data loss
CDelete unnecessary files to reduce clutter
DShare the evidence with others before analysis
Step-by-Step Solution
Solution:

  1. Step 1: Identify proper evidence collection procedure

    Documenting the scene preserves context and chain of custody.

  2. Step 2: Understand why documentation comes before handling

    It prevents loss of important details and maintains evidence integrity.

  3. Final Answer:

    Document the scene and evidence before touching anything -> Option A

  4. Quick Check:

    Document first = Preserve context [OK]
Quick Trick: Always document before touching evidence [OK]
Common Mistakes:
MISTAKES
  • Turning off devices without documentation
  • Deleting files thinking it helps
  • Sharing evidence too early

Want More Practice?

15+ quiz questions · All difficulty levels · Free

Free Signup - Practice All Questions
More Cybersecurity Quizzes
Advanced Threat Protection - Endpoint Detection and Response (EDR) - Quiz 10hard Advanced Threat Protection - Malware analysis basics - Quiz 3easy Compliance and Governance - SOC 2 compliance - Quiz 14medium Compliance and Governance - Risk assessment methodologies - Quiz 9hard Emerging Security Topics - Supply chain security - Quiz 11easy Incident Response - Containment strategies - Quiz 4medium Security Architecture and Design - Network segmentation - Quiz 10hard Security Architecture and Design - Defense in depth strategy - Quiz 7medium Security Architecture and Design - Secure SDLC practices - Quiz 5medium Security Architecture and Design - Threat modeling (STRIDE, DREAD) - Quiz 2easy