Question: A company's cybersecurity staff discovered an attack on a PC on the internal network. Checking the network protocol analyzers, they notice that the PC is
A company's cybersecurity staff discovered an attack on a PC on the internal network. Checking the network protocol analyzers, they notice that the PC is currently on and demonstrating suspicious behavior. If it is necessary to collect evidence directly from the PC, in what order should it be done, taking into account the volatility of the PC information?
Step by Step Solution
There are 3 Steps involved in it
When collecting evidence directly from a compromised PC its essential to follow a careful and structured approach to avoid altering or destroying critical data The following steps provide a suggested ... View full answer
Get step-by-step solutions from verified subject matter experts
