Question

what is the first step when initiating a digital forensics examination?
a. identify needs of the examination.
b. select the appropriate acquisition tool.
c. wipe the target drives for the acquisition.
d. properly preserve the evidence.

Explanation:

Digital forensics examinations start with defining the scope and goals by first identifying what the examination needs to achieve, as this guides all subsequent steps like tool selection or evidence handling. Wiping drives is not an initial step, and preserving evidence comes after clarifying the examination's purpose.

Answer:

a. Identify needs of the examination.