CompTIA Security Plus Mock Test Q1387

Which of the following is the FIRST step in a forensics investigation when a breach of a client’s workstation has been confirmed?

A. Transport the workstation to a secure facility
B. Analyze the contents of the hard drive
C. Restore any deleted files and / or folders
D. Make a bit-for-bit copy of the system

Correct Answer: D
Section: Mixed Questions