Question

A security analyst seizes a laptop suspected of being used in a data theft incident. The organization anticipates the case may go to court. To ensure the digital evidence remains admissible, which action should the analyst prioritize when handling the laptop's storage drive?

Accepted Answer

Create a bit-for-bit forensic image, calculate a cryptographic hash, and document every transfer of the evidence

Answer

Immediately boot the laptop and browse the file system to identify stolen data

Answer

Copy the suspicious files to a USB drive and store the laptop in a locked cabinet

Answer

Run antivirus and a vulnerability scan on the drive to catalog any malware present