Which of the following should be acquired LAST?

An incident responder is preparing to acquire images and files from a workstation that has been compromised. The workstation is still powered on and running.

Which of the following should be acquired LAST?
A . Application files on hard disk
B . Processor cache
C . Processes in running memory
D . Swap space

View Answer

Answer: A