Question

A technician is called to a workstation where a user is suspected of storing illegal material. The manager asks the technician to investigate the machine immediately. According to incident response best practices, what should the technician do FIRST?

Accepted Answer

Preserve the data in its current state and document the chain of custody without altering the system

Answer

Copy the suspicious files to a USB drive and hand them to the manager for review

Answer

Delete the illegal material immediately to protect the company from liability

Answer

Run a full antivirus scan and quarantine anything flagged on the drive