To ensure proper evidence collection, which of the following steps should be preformed FIRST? SY0-401 To ensure proper evidence collection, which of the following steps should be preformed FIRST? A. Take hashes from the live system B. Review logs C. Capture the system image D. Copy all compromised files Answer: C Learn More : Share this Share on FacebookTweet on TwitterPlus on Google+