Exam CS0-002 topic 1 question 281 discussion

C and E are the best actions to help during the forensic analysis of the mobile device as they preserve the evidence and make it easier to analyze. C: Documenting the chain of custody helps to establish the authenticity of the evidence and its proper handling. E: Performing a memory dump of the mobile device is important to preserve volatile data that may not be available otherwise, and can be useful for analysis to identify the attack vector and determine the extent of the compromise. Resetting the phone to factory settings (A) would erase all the data, including the evidence that could have helped in the investigation. Rebooting the phone and installing the latest security updates (B) may be helpful, but it would not help preserve the evidence. Uninstalling any potentially unwanted programs (D) may help, but this would not be a priority during a forensic analysis. Unlocking the device by blowing the eFuse (F) is not relevant to the investigation.

CE is correct