Exam 212-89 topic 1 question 16 discussion

Actual exam question from ECCouncil's 212-89

Question #: 16
Topic #: 1

Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics process:

A. Examination> Analysis > Preparation > Collection > Reporting
B. Preparation > Analysis > Collection > Examination > Reporting
C. Analysis > Preparation > Collection > Reporting > Examination
D. Preparation > Collection > Examination > Analysis > Reporting

Show Suggested Answer

Suggested Answer: D 🗳️

by John2314 at Feb. 1, 2023, 3:32 p.m.

Comments

Submit Cancel

abrotechit

9 months ago

Logically: You cannot examine an evidence you have not collected. You produce a report ONLY after analysing the evidence to map thre incidents to various actors. so Collection before examination, analysis before reporting.

upvoted 1 times

...

John2314

11 months ago

What is the difference between Examination and Analysis? In the book says PREINVESTIGATION PHASE, INVESTIGATION PHASE, POST INVESTIGATION PHASE. However, in google has described in 5 phases: Identification Preservation Analysis. Documentation. Presentation.

upvoted 1 times

...