[CORRECT] D. Recover the evidence.
One must first collect evidence, then analyze to determine whether a crime was actually committed.
[INCORRECT] Option C. Determine whether a crime was actually committed.
This happens much later in the process, during analysis.
-----------------
EC Council Official Curricula
Computer Hacking Forensic Investigator
https://bookshelf.vitalsource.com/reader/books/9781635676969/
Module 02 Page 164
Analyzing the Data
"Investigators must thoroughly analyze the acquired data to draw conclusions related to the case."
From the official EC Council courseware - step 1 is recover the evidence. Seize the email accounts, acquire the email data, examine the messages and then the headers.
The question is unclear as to what stage of the process the investigation is at. At the very beginning of an email investigation, wouldn't you want to retrieve the email in question?
I agree with JDKirk, if it's a "potential" crime and this is the first step, why would we start tracing IP addresses and how could we trace IP addresses if we didn't first recover the evidence?
...maybe the word, "recover" excludes D as the best choice since it means specifically that something was hidden or destroyed which isn't necessarily the case within this context so the next best answer is tracing the IP address?
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
044f354
4 months ago4bd3116
11 months, 2 weeks agoDumas
1 year agoDumas
1 year agoElb
1 year, 1 month agovcloudpmp
3 years, 4 months agoK3nz0420
3 years, 4 months agoJDKirk
3 years, 7 months agoAspiringScriptKiddie
3 years, 4 months ago