(a) When a forensic examiner arrives at a crime scene, the first task done is referred to as "Incident Response". Summarize the different incident response tasks done in 10 steps.
(b) If volatile data acquisition has not been done, how can the forensic examiner still be able to gather some RAM data after system was powered off?
(c) What is the best way to shut down the following system (i) Windows XP and (ii) Windows Server 2005? Why?
(d) Name five different volatile information that can be captured during live acquisition.