What would be the next sequence of events after securing the incident scene and labeling cables?

• A. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media
• B. Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence
• C. Connect the target media; Delete the system for acquisition; Secure the evidence; Copy the media
• D. Secure the evidence; Prepare the system for acquisition; Connect the target media; Copy the media

Answer: (B)

In digital forensics, after securing the scene and labeling cables, the immediate focus is on acquiring data in a forensically sound way. Start by preparing the system for acquisition: set up the forensic workstation, apply write-blockers to prevent any writes to the original media, enable proper logging, and ensure tools are ready to capture evidence without altering it. Next, connect the target media to the acquisition setup so you can access its contents safely. Then copy the media by creating a forensic image (a bit-for-bit copy) and verify it with a hash to prove integrity. Finally, secure the evidence by documenting the process, labeling and sealing the media, and maintaining the chain of custody.