Question

you are conducting a forensic investigation. the attack has been stopped. which of the following actions should you perform first? answer turn off the system. document what is on the screen. remove the hard drive. stop all running processes.

Answer 1

Document what is on the screen

After a threat has been nullified, computer systems might undergo a forensic examination to gather information and determine the attack's methodology. A trade-off occurs while trying to preserve evidence while performing a forensic investigation. Any attempt to gather evidence could end up destroying the very information needed to pinpoint an assault or attacker. Documenting what is on the screen is the option that is least intrusive and least likely to obliterate important evidence. Running processes may be stopped, broken down, or stopped, which could wipe any data necessary for tracking the intrusion.

To know more about forensic investigation : https://brainly.com/question/12640045?referrer=searchResults

#SPJ4