What are the core components of a digital forensics procedure?

• A. Evidence collection, chain of custody, analysis methods, and reporting.
• B. Only network scanning and vulnerability assessment.
• C. Only legal research.
• D. Only asset inventory.

Answer: (A)

Digital forensics rests on a disciplined, defensible workflow that ensures evidence is handled properly from start to finish. The essential pieces are collecting and preserving all relevant data without altering it, maintaining a documented chain of custody so every person who touched the evidence is recorded, applying systematic analysis methods to interpret the data and uncover artifacts, and documenting and communicating the findings in a clear, reproducible report. This combination makes the evidence trustworthy and usable in investigations or legal settings.

Other activities like network scanning and vulnerability assessment, legal research, or asset inventory touch on security assessment, legal context, or asset management, but they are not the core procedural steps of conducting a digital forensic examination.