← Windows Forensic Acquisition — Triage, Imaging, and Chain of Custody

Module Quiz

10 questions · Pass at 80%

Question 1 of 10

An incident responder arrives at a compromised workstation that is still running. According to the order of volatility, which artifact MUST be collected first?