ISC2 Exam ISSMP Topic 1 Question 15 Discussion

The following steps are generally followed in computer forensic examinations.

1.Acquire. In this step, the examiner gets an exact duplicate copy of the original data for investigation. The examiner leaves the original copy intact.

2.Authenticate. In this step, the investigator shows that the data is unchanged and has not been tampered.

3.Analyze. In this step, the examiner analyzes data carefully. The examiner recovers evidence by examining hard disk drives, hidden files, swap data, the Internet cache, and the Recycle bin.

Answer option D is incorrect. Encrypt is not a step followed in computer forensic examinations.