CISM Certified Information Security Manager – Question0887

Which of the following is MOST important when conducting a forensic investigation?

A.
Documenting analysis steps
B. Capturing full system images
C. Maintaining a chain of custody
D. Analyzing system memory

Correct Answer: C