During the last incident, responders spent hours locating write blockers, clean media and approved forensic software before they could begin collecting evidence. What would BEST prevent this delay?
Select an answer to reveal the explanation.
Short Explanation
You don't go shopping for a fire extinguisher when the kitchen is already on fire. A ready-to-go jump kit means your team starts working the minute they arrive. The trap is relying on the compromised machine's own tools, which you can't trust.
Full Explanation
Forensic readiness means the organization can collect and preserve evidence quickly and defensibly when an incident occurs. A prepared toolkit, sometimes called a jump kit, contains validated forensic software, write blockers, sterile storage media, chain-of-custody forms and procedures, and it is checked and maintained on a schedule so responders can begin immediately. Purchasing tools at the start of each incident adds procurement delay at the worst possible time, and new tools would not have been validated or practised with. Using tools installed on the affected systems is unreliable because those binaries may have been altered by the attacker, and running them can change the very evidence being collected. Asking the internet service provider to collect evidence is not realistic: the provider has no access to internal hosts, no obligation to act for the organization and no role in its chain of custody. Exam caveat: readiness also includes trained people and documented procedures, so a toolkit alone does not make a team ready, but its absence guarantees delay. Operational check: confirm the toolkit inventory, the date of its last validation, licence currency and that each responder knows where it is and how to use it.