Which of the following should the analyst do FIRST?

exams SY0-501 SY0-501 exam 0 Comments

A forensics analyst is investigating a hard drive for evidence of suspected illegal activity.

Which of the following should the analyst do FIRST?
A . Create a hash of the hard drive.
B . Export the Internet history.
C . Save a copy of the case number and date as a text file in the root directory.
D . Back up the pictures directory for further inspection.

Answer: C