Practice Quiz

CompTIA 220-801 Certification Practice Test

Category - Essentials

Start a Study Session Sign up for Question of the Day
A technician is conducting a forensics analysis on a computer system. Which step should be taken first?
  1. Get a binary copy of the system
  2. Search for Trojans
  3. Look for hidden files
  4. Analyze temporary files
Explanation
Answer - A - The first step in the forensic analysis of an infected system is to obtain the binary copy of the system.

Key Takeaway: A system cannot be analyzed or searched for evidence using a simple file copy. The investigators need to obtain the binary copy to preserve evidence. This copy must be tamper-proof and must be capable of independent verification.
Previous Next
Was this helpful? Upvote!
Login to contribute your own answer or details
Start a Study Session Sign up for Question of the Day

Top questions

Related questions

Most popular on PracticeQuiz