Liam, a certified digital forensics technician, is dispatched to a corporate office after a suspected...

Vendor: ECCouncil
Product: 212-89
Update on: Nov 5, 2026
Questions: 356

ECCouncil 212-89 Question Answer

Liam, a certified digital forensics technician, is dispatched to a corporate office after a suspected insider breach involving unauthorized data exfiltration. Upon arrival, he immediately begins organizing the collection process. He carefully labels each seized device—including laptops, USB drives, and smartphones—with exhibit tags that include his initials, the date and time of seizure, and a unique exhibit number. For each item, he records detailed descriptions in an official evidence logbook, noting the device make, serial number, condition, and where it was found. He also ensures that all items are photographed in their original positions before being moved. As he prepares them for secure packaging and transport, Liam initials each log entry and keeps a running record of who will take charge of the evidence next. Which aspect of evidence handling is Liam demonstrating?

Installing endpoint detection software

Imaging volatile memory

Executing malware removal procedures

Creating a chain of custody record