Computer Hacking Forensic Investigator (CHFI v10) — Question 334

Which of the following is NOT a part of pre-investigation phase?

Answer options

• A. Building forensics workstation
• B. Gathering information about the incident
• C. Gathering evidence data
• D. Creating an investigation team

Correct answer: C

Explanation

The correct answer is C because gathering evidence data is typically part of the investigation phase, not the pre-investigation phase. The other options involve preparatory steps that should be completed before the actual investigation begins.