- Study guides, Class notes & Summaries

IT 3530 Test 2 | Questions with complete solutions Which data source comes first in the order of volatility when conducting a forensic investigation? a)Random access memory (RAM) b)Files on disk c)Swap and paging files d)Logs During which step of the incident-handling process should a lessons-learned review of the incident be conducted? a)Response b)Notification c)Documentation d)Recovery and follow-up During which step of the incident-handling process does triage take place? a)Notification b...