you are a cybersecurity forensic analyst. when conducting an investigation, which of the following actions should you perform first to ensure the highest chance of success in the investigation?
Secure the evidence
Document the chain of custody
Examine pieces of evidence one by one
Use cyber forensic tools



Answer :

As a cybersecurity analyst, when conducting an investigation you should first secure the evidence to ensure the highest chance of success in the investigation. A thorough, well-thought-out plan for gathering evidence is perhaps the most important component of a successful computer forensic investigation.

Evidence gathering must be done in a planned and legal manner. Given the intricacy of most cybersecurity investigations, it is very important for computer forensics to be able to establish and validate the chain of evidence while pursuing a legal case.

There must be extensive documentation before, during, and after the acquisition process; particular information, such as all hardware and software specifications, any systems employed in the investigation process, and the systems under investigation, must be recorded and archived. Policies pertaining to maintaining the integrity of prospective evidence are particularly applicable at this stage.

The removal of storage devices physically, the use of controlled boot discs to retrieve sensitive data and guarantee operation, and following the proper measures to copy and transfer evidence to the investigator's system are all general criteria for evidence preservation.

To learn more about cybersecurity analyst click here:

brainly.com/question/28274206

#SPJ4