Joe a computer forensic technician responds to an active compromise of a database server. Joe first collects information in memory, then collects network traffic and finally conducts an image of the hard drive.Which of the following procedures did Joe follow?

A. Order of volatility
B. Chain of custody
C. Recovery procedure
D. Incident isolation

Answer: A. Order of volatility

Computer Science & Information Technology

You might also like to view...

OneNote notebooks stored on the Office 365 server can be edited by more than one person at the same time with edits updating automatically

Indicate whether the statement is true or false

Computer Science & Information Technology

How do you change the indexing options and locations in Windows 7?

A) Start button, type Indexing Options in the Search box, and click Indexing Options B) Start button, All Programs, and Indexing Options C) Start button, Indexing, and click Indexing Options D) Start button, All Programs, Indexing, and Options

Computer Science & Information Technology