A company's financial data system was breached, and investigators are now gathering and preserving digital evidence from the compromised computers and servers to understand what happened and potentially use the findings in legal proceedings. The application of investigation and analysis techniques for this purpose is called:

Question

BlackTom AI · Accepted Answer

The scenario centers on preserving and examining digital evidence from compromised systems to understand events and potentially support legal action. This aligns with computer forensics, which involves the systematic collection, preservation, analysis, and presentation of digital evidence.
Option 1: Computer forensics. This choice matches the described purpose of gathering and preserving digital evidence for potential use in legal proceedings, focusing on proper evidence handling and analysis.
Option 2: Disaster recovery. While important for restoring normal operations after a failure or breach, disaster recovery concentrates on resuming business functions and availability, not on evidentiary collection and legal admissibility.
Option 3: Incident response. This discipline covers the immediate actions taken to detect, contain, eradicate, and recover from a security incident. It addresses containment and remediation rather than the forensic analysis and legal presentation of evidence, though it may precede forensic work.
Option 4: Intrusion detection. This refers to identifying unauthorized access or suspicious activity, typically through monitoring systems. It’s about detection, not the broader process of evidentiary gathering and analysis for proceedings.
In summary, the description most closely corresponds to computer forensics because it emphasizes preserving and analyzing digital evidence for potential legal use, whereas the other options describe related but distinct phases or goals of cybersecurity and IT resilience.

View Explanation

Log in for full answers

Similar Questions

Which of the following is a crucial step in the digital forensic investigation methodology?

A digital forensic investigator is examining a computer system suspected to contain evidence of unauthorized access. In this context, which principle is critical for the investigator to adhere to during the investigation?

What is a primary responsibility of a Digital Evidence First Responder (DEFR)?

How can the principle of reliability be ensured in digital evidence handling?

What is the correct procedure if a device at an incident site is found to be powered ON?

What is the purpose of auditing and justifying the procedures followed in digital evidence acquisition?

What are the options available to the DEFR for acquiring potential digital evidence from CCTV systems?

What should the DEFR do before disconnecting a networked device from the network?

More Practical Tools for Students Powered by AI Study Helper

Homework AI Solver

Stylized AI Paper Writer

Plagiarism Checker Assistant

Citation AI Academic Writing Tool

In-Class Translation Assistant

AI Note Generator

AI Quiz Answers

Past Exam Questions from University Test Bank

Smart Practice Assistant

Adaptive Practice

Making Your Study Simpler