Certified Incident Handler (ECIH v3) — Question 40

Computer forensics is methodical series of techniques and procedures for gathering evidence from computing equipment, various storage devices and or digital media that can be presented in a course of law in a coherent and meaningful format. Which one of the following is an appropriate flow of steps in the computer forensics process:

Answer options

• A. Examination> Analysis > Preparation > Collection > Reporting
• B. Preparation > Analysis > Collection > Examination > Reporting
• C. Analysis > Preparation > Collection > Reporting > Examination
• D. Preparation > Collection > Examination > Analysis > Reporting

Correct answer: D

Explanation

The correct answer is D because the computer forensics process begins with Preparation, followed by Collection of evidence, Examination of that evidence, Analysis to interpret the findings, and finally Reporting the results. The other options do not follow this logical order, which is essential for ensuring that the evidence is handled correctly and can be used in legal proceedings.