Security Operations
Question #32
A forensic analyst is investigating a suspect's computer in a financial fraud case to recover deleted files. What should be the first step of the analyst?
A. Execute a full disk imaging process to create a secure, bit-by-bit copy of the hard drive for analysis in a controlled environment.
B. Apply file carving methods that rely on file signatures to recover deleted files without relying on the file system.
C. Use data remanence techniques to analyze residual magnetic patterns on the hard drive.
D. Check the system’s page and swap files for fragments of deleted files.
Domain Concept: Security Operations
This scenario evaluates management-level decision making in Security Operations. In CISSP exam scenarios, evaluate answers through executive governance, risk assessment, life safety, and due diligence before implementing technical controls.
💡 View the Answer & Detailed Explanation
The correct answer to this scenario-based question requires an understanding of the CISSP Managerial Mindset. Register to view our in-depth explanation and access 1100+ adaptive questions completely free.