A file server has been compromised. You need to ensure that non-volatile data is preserved as part of the investigation. Which of the following is the BEST way to do this?
A. Image the hard drive.
B. Copy the hard drive's data to DVD.
C. Complete an incremental backup of the hard drive's data.
D. Complete a differential backup of the hard drive's data.
A
Explanation: You should image the hard drive to ensure that all non-volatile data is preserved.
None of the other options ensures that all the non-volatile data is preserved. When you copy data to a DVD, there is a possibility that open files will not be copied. Incremental and differential backups only back up data since the last full backup (or incremental backup).
You might also like to view...
_________ control controls how particular services are used.
A. Service B. Behavior C. User D. Direction
What does the following information indicate if the show interfaces status command is entered on a switch.
Gi0/2 notconnect 1 auto auto unknown