Exam CAS-004 topic 1 question 244 discussion

Order of Volatility is correct

In forensics, order of volatility refers to the order in which you should collect evidence. Highly volatile data is easily lost, such as data in memory when you turn off a computer. Less volatile data, such as printouts, is relatively permanent and the least volatile ANSWER IS A see: https://blogs.getcertifiedgetahead.com/cfr-and-order-of-volatility/#:~:text=In%20forensics%2C%20order%20of%20volatility%20refers%20to%20the,printouts%2C%20is%20relatively%20permanent%20and%20the%20least%20volatile.

It's A....everyone should know this by now....

I think this Order of Volitility

A. Order of Volitility

I think a

The security analyst should have followed the "order of volatility". This principle outlines that evidence with the highest volatility, or that which is most likely to change or be lost, should be gathered first. In the case of a running process, it is volatile and can be lost if the machine is shut down or rebooted. The appropriate course of action would have been to consult with a forensic analyst before turning off or rebooting the machine, so that critical evidence is preserved. The chain of custody refers to the documentation and tracking of evidence so that it is not tampered with, altered or misplaced. Verification of evidence refers to ensuring the accuracy of the data collected, and secure storage refers to the proper storage of evidence to prevent tampering, damage or loss.