GIAC Certified Forensic Analyst (GCFA) — Question 33

Adam works as a professional Computer Hacking Forensic Investigator with the local police of his area. A project has been assigned to him to investigate a PDA seized from a local drug dealer. It is expected that many valuable and important information are stored in this PDA. Adam follows investigative methods, which are required to perform in a pre-defined sequential manner for the successful forensic investigation of the PDA. Which of the following is the correct order to perform forensic investigation of PDA?

Answer options

• A. Identification, Collection, Examination, Documentation
• B. Examination, Collection, Identification, Documentation
• C. Documentation, Examination, Identification, Collection
• D. Examination, Identification, Collection, Documentation

Correct answer: D

Explanation

The correct sequence for a forensic investigation is Examination, Identification, Collection, and Documentation, as outlined in answer D. This order ensures that evidence is properly examined and identified before being collected, with thorough documentation throughout the process to maintain integrity. The other options do not follow this logical order, which could compromise the investigation's effectiveness.