In incident response, Acquisition is best described as

In incident response, Acquisition is best described as

• A. Imaging the network to recover data
• B. Decrypting encrypted files during live analysis
• C. Logging system events for audit
• D. The process of extracting digital contents from a seized device so they may be analyzed

Answer: (D)

Acquisition in incident response is the step of collecting and preserving digital evidence from devices involved in an incident so it can be analyzed later. This includes extracting digital contents from a seized device and creating a forensically sound copy of the data, with documentation to maintain the chain of custody. That description matches best because it centers on obtaining data from a physical device for subsequent analysis. The other activities relate to different tasks—gathering data from a network, decrypting files during analysis, or logging events for audits—rather than the act of acquiring evidence from a seized device.

Acquisition in incident response is the step of collecting and preserving digital evidence from devices involved in an incident so it can be analyzed later. This includes extracting digital contents from a seized device and creating a forensically sound copy of the data, with documentation to maintain the chain of custody. That description matches best because it centers on obtaining data from a physical device for subsequent analysis. The other activities relate to different tasks—gathering data from a network, decrypting files during analysis, or logging events for audits—rather than the act of acquiring evidence from a seized device.