Câu 228: SY0-501: CompTIA Security+

A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take the chain of custody?

1. A. Make a forensic copy
2. B. Create a hash of the hard drive
3. C. Recover the hard drive data
4. D. Update the evidence log — đáp án hiện tại