Scenario

A USB drive found in the parking lot may become evidence. Which handling keeps it useful in an investigation?

Use data sources to support an investigation

APlug it into a front-desk PC to see who it belongs toBRecord who found it, who received it, when, and store it sealed; image it later on an isolated system and hash the imageCFormat it so it can be reused as a loanerDLeave it on the receptionist’s desk until the owner claims it

Pick an answer. You’ll see if it’s right. The longer explanation is what a plan opens.

Why

Nearby items

4.8 · Ransomware is confirmed on one workstation. The share it was encrypting has been disconnected by a user who no…
5.5 · Leadership wants to walk through a ransomware decision tree — who isolates a host, who talks to counsel, who s…

28 items in the public index.