Which of the following should the analyst do FIRST?

A forensics analyst is investigating a hard drive for evidence of suspected illegal activity.

Which of the following should the analyst do FIRST?
A . Create a hash of the hard drive.
B . Export the Internet history.
C . Save a copy of the case number and date as a text file in the root directory.
D . Back up the pictures directory for further inspection.

View Answer

Answer: C