Question: With the initial investigative approach determined the incident response team must implement security over the incident scene. Once physical security is initiated on the scene the identification and preservation of the digital evidence must occur. Describe the process of this Identification and Preservation step over the digital evidence.
• Describe the processes of incident scene security, and describe how important this step is to evidence preservation and control.
• Take this opportunity to describe the process of evidence identification, categorization, and logging into Chain of Custody.
• Describe the use of flags or photo tents to identify evidence, and evidence locations. Explain the importance of this evidence identification.