ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 212-89 All Questions

View all questions & answers for the 212-89 exam
Go to Exam

Exam 212-89 topic 1 question 16 discussion

Actual exam question from ECCouncil's 212-89
Question #: 16
Topic #: 1
[All 212-89 Questions]

Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics process:

  • A. Examination> Analysis > Preparation > Collection > Reporting
  • B. Preparation > Analysis > Collection > Examination > Reporting
  • C. Analysis > Preparation > Collection > Reporting > Examination
  • D. Preparation > Collection > Examination > Analysis > Reporting
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by John2314 at Feb. 1, 2023, 3:32 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
abrotechit
7 months, 1 week ago
Logically: You cannot examine an evidence you have not collected. You produce a report ONLY after analysing the evidence to map thre incidents to various actors. so Collection before examination, analysis before reporting.
upvoted 1 times
...
John2314
9 months, 1 week ago
What is the difference between Examination and Analysis? In the book says PREINVESTIGATION PHASE, INVESTIGATION PHASE, POST INVESTIGATION PHASE. However, in google has described in 5 phases: Identification Preservation Analysis. Documentation. Presentation.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago