Following an Incident, an Administrator Is Gathering Forensic Evidence from a Server

Multiple Choice

Following an incident, an administrator is gathering forensic evidence from a server for a human resources investigation. Which of the following best practices is MOST important to document throughout the process to maintain integrity of the findings?

A) Acceptable use policy violations
B) Server configuration
C) Chain of custody
D) Data loss incidents