CIS 359 STUDY Great Stories/cis359study.com CIS 359 STUDY Great Stories/cis359study.com | 页面 13

The ____ phase of forensic analysis involves the use of forensic
tools to recover the content of files that were deleted, operating system
artifacts (such as event data and logging of user actions), and other
relevant facts.
•
Question 41
Because it is possible for investigators to confuse the suspect and
destination disks when performing imaging, and to preclude any grounds
for challenging the image output, it is common practice to protect the
suspect media using a ____.
•
Question 42
If a user receives a message whose tone and terminology seems
intended to invoke a panic or sense of urgency, it may be a(n) ____.
•
Question 43
When an incident includes a breach of physical security, all
aspects of physical security should be escalated under a containment
strategy known as ____.