Computer Hacking Forensic Investigator (CHFI) — Question 118

When investigating a potential e-mail crime, what is your first step in the investigation?

Answer options

• A. Trace the IP address to its origin
• B. Write a report
• C. Determine whether a crime was actually committed
• D. Recover the evidence

Correct answer: D

Explanation

The first step in an investigation is to recover the evidence, as this is crucial for establishing the facts of the case. Without collecting evidence, you cannot accurately assess whether a crime occurred or effectively trace IP addresses. Writing a report and determining if a crime was committed come after the evidence is secured.