A desktop computer is being used to perpetrate a fraud, and data on the machine must be secured for evidence. Which of the following should be done FIRST?

A. Encrypt the content of the hard drive using a strong algorithm.

B. Obtain a hash of the desktop computer's internal hard drive.

C. Copy the data on the computer to an external hard drive.

D. Capture a forensic image of the computer.








 

Suggested Answer: B



This question is in CISM exam 
For getting Certified Information Security Manager Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to ISACA.