While collecting digital evidence from a running computer involved in a cybercrime, the forensic investigator makes a list of items that need to be collected.
Which piece of digital evidence should be collected first?
Comprehensive and Detailed Explanation From Exact Extract:
When collecting evidence from a running system, volatile and critical evidence such as security logs should be collected first as they are most susceptible to being overwritten or lost. Security logs may contain valuable information on unauthorized access or malicious activity.
Chat room logs, recently accessed files, and temporary internet files are important but often less volatile or can be recovered from disk later.
NIST SP 800-86 and SANS Incident Response Guidelines prioritize the collection of volatile logs and memory contents first.
This approach helps ensure preservation of time-sensitive data critical for forensic analysis.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit