Which practice involves communicating incident handling and the response process and is also an important part of evidence gathering?

Which practice involves communicating incident handling and the response process and is also an important part of evidence gathering?

• A. Backing up log files
• B. Make a bit-level copy
• C. One-to-one copy
• D. Restore and repair any damage

Answer: (A)

In incident response, documenting how you handle an incident and the steps you take is essential, and that documentation also serves as key evidence. Backing up log files creates a durable record of events, alerts, user actions, and system changes that occurred during the incident. This preserved log data ensures you can review the exact sequence of events later, even if original logs are overwritten, rotated, or damaged in the chaos of the incident. Those logs become a shared reference for the team, helping coordinate containment and recovery, while also establishing a verifiable trail for investigators or auditors. Preserving this information supports the chain of custody and enables accurate post-incident analysis. Other choices relate to different aspects of forensics or remediation: making a bit-level or exact copy is about duplicating data for analysis, and restoring or repairing focuses on restoring systems rather than capturing how the incident was handled.

In incident response, documenting how you handle an incident and the steps you take is essential, and that documentation also serves as key evidence. Backing up log files creates a durable record of events, alerts, user actions, and system changes that occurred during the incident. This preserved log data ensures you can review the exact sequence of events later, even if original logs are overwritten, rotated, or damaged in the chaos of the incident. Those logs become a shared reference for the team, helping coordinate containment and recovery, while also establishing a verifiable trail for investigators or auditors. Preserving this information supports the chain of custody and enables accurate post-incident analysis.

Other choices relate to different aspects of forensics or remediation: making a bit-level or exact copy is about duplicating data for analysis, and restoring or repairing focuses on restoring systems rather than capturing how the incident was handled.