Are you studying for the CHFI certification?
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
What is the First Step required in preparing a computer for forensics investigation?
Do not turn the computer off or on, run any programs, or attempt to access data on a computer
Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination
Secure any relevant media
Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue
I think the very first step is "Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue" because if we'll keep system ON then attacker can somehow destroy evidence including volatile information. And "Do not turn the computer off or on, run any programs, or attempt to access data on a computer" is just an instruction.
Edited: The correct answer according to CHFI is "Do not turn the computer off or on, run any programs, or attempt to access data on a computer" you can verify it in Module 02, Page 63. Stick to the answer provided in the material and not the one that you "think" or "believe" is correct. Sadly, this is why people who are proficient usually fail at certification exams, because they rely on their knowledge and experience instead of the information provided in the material.
Study thousands of practice questions that organized by skills and ranked by difficulty.
Create a tailored training plan based on the knowledge you already possess.
Know when you’re ready for the high-stakes exam. Have the confidence that you will pass on your first attempt.