フリー問題

問題文

An analyst wants to look at a suspicious executable that was pulled off an infected workstation, using the laptop she works on every day. What does the examiner insist on?

選択肢

1. The examiner insists on the network capturing because the risk to that evidence comes from the transient traffic and the file must record the stored packets at each step.
2. The examiner insists on the carving recovery because the risk to that evidence comes from the deleted fragments and the file must record the reconstructed files at each step.
3. The examiner insists on the controlled handling because the risk to that evidence comes from the accidental execution and the file must record the isolated workspace at each step.
4. The examiner insists on the chain reconstruction because the risk to that evidence comes from the incomplete documentation and the file must record the corroborating record at each step.