Exam SY0-701 topic 1 question 522 discussion

Acquisition is relevant to the investigation. Preservation is relevant to protect data, store data, etc.

The correct answer is: A. Acquisition Explanation: Acquisition is the stage in a forensic investigation where forensic images of digital evidence (e.g., hard drives, memory, or other storage devices) are obtained. This process involves creating a bit-by-bit copy of the data to ensure its integrity and to allow for analysis without altering the original evidence. Preservation (B) involves ensuring that the evidence is protected from tampering or alteration, often occurring before or during acquisition. Reporting (C) is the final stage where findings are documented and presented. E-discovery (D) refers to the process of identifying, collecting, and producing electronically stored information (ESI) in response to legal requests, which is not specific to the creation of forensic images. Thus, Acquisition is the stage where forensic images are obtained.