Which process should be enabled to support timely forensic investigation in the event of a compromise?

Which process should be enabled to support timely forensic investigation in the event of a compromise?

• A. Backups
• B. Forensic investigation processes
• C. Incident response training
• D. Penetration testing

Answer: (A)

Timely forensic investigation hinges on having reliable data available for analysis without disturbing the live system. Backups provide restore points and preserve critical information from before and during an incident, allowing investigators to recover data, reconstruct events, and examine artifacts in a controlled, defensible way. This makes it possible to verify what happened, understand the sequence of actions, and preserve evidence even if the primary systems are compromised or logs are tampered with. While having a defined forensic process, incident response training, or proactive testing is important for overall incident handling, they don’t by themselves guarantee access to pristine data or a recoverable state for analysis. Backups are the concrete enabler that makes forensic analysis feasible and timely.

Timely forensic investigation hinges on having reliable data available for analysis without disturbing the live system. Backups provide restore points and preserve critical information from before and during an incident, allowing investigators to recover data, reconstruct events, and examine artifacts in a controlled, defensible way. This makes it possible to verify what happened, understand the sequence of actions, and preserve evidence even if the primary systems are compromised or logs are tampered with.

While having a defined forensic process, incident response training, or proactive testing is important for overall incident handling, they don’t by themselves guarantee access to pristine data or a recoverable state for analysis. Backups are the concrete enabler that makes forensic analysis feasible and timely.