Describe the basic principles of digital forensics and evidence handling. If you suspected a workstation was compromised, what steps would you take to preserve evidence while investigating?

Sample answer preview

Digital forensics is the process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable. While security analysts may not perform full forensic investigations, understanding forensic principles ensures evidence is not…