Evidence gathered during an incident may end up in court, in a regulator's review or in an insurance claim, and it is also what you rely on to understand what happened. Collecting it correctly means capturing it before it disappears, proving it has not been altered and documenting who handled it. The exam tests four related ideas: the order of volatility, chain of custody, legal hold, and forensic imaging with hash validation.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.