Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
A . Restored media from full backup of the infected host
B . Media from the infected host, copied to the dedicated IR host
C . Original media from the infected host
D . Bit-for-bit image from the infected host

View Answer

Answer: A

Explanation:

By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.