A company's cybersecurity staff discovered an attack on a PC on the internal network. Checking the network protocol analyzers, they notice that the PC is currently on and demonstrating suspicious behavior. If it is necessary to collect evidence directly from the PC, in what order should it be done, taking into account the volatility of the PC information?

Answer rating: 100% (QA)

When collecting evidence directly from a compromised PC its essential to follow a careful and structured approach to avoid altering or destroying critical data The following steps provide a suggested ... View the full answer