Certified Incident Handler (ECIH v3) — Question 33

A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:

Answer options

• A. Analysis
• B. Preparation
• C. Examination
• D. Collection

Correct answer: C

Explanation

The correct answer is C, Examination, as this phase involves analyzing and processing the data to extract relevant information. Options A (Analysis) and D (Collection) are related but do not specifically refer to the detailed review of data. Option B (Preparation) refers to the initial setup before data is gathered and does not involve data processing.