During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?
A . examination
B . investigation
C . collection
D . reporting

View Answer

Answer: C

Explanation:

During the collection phase of the forensic process, data related to a specific event is labeled and recorded to preserve its integrity. This step ensures that the data remains unaltered and authentic from the time of collection until it is presented as evidence, maintaining the chain of

custody.

Reference: = Cisco Cybersecurity Operations Fundamentals – Module 6: Security Incident Investigations