Study. uk . com
  1. Home
  2. All questions
  3. Question 597

CompTIA Security+ study material · question 597 of 611

Why does the forensic collection stage begin with identifying possible data sources?

  1. To estimate the storage required
  2. To establish the chain of custody
  3. To determine which analyst is assigned
  4. Because evidence that was never collected cannot be examined later
Show the answer

Answer: D. Because evidence that was never collected cannot be examined later

Volatile and short-retention sources disappear, so the enumeration has to happen before collection begins.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 3.1.1 Identifying Possible Sources of Data

Challenge yourself on this topic → Study as cards