1
Q
Preparation
A
first step: training certification and instruction on forensic tools
2
Q
Collection
A
second step: recording computer log files
3
Q
Analysis
A
third step: Exam the evidence
4
Q
Reporting
A
Fourth step: write a report of the incident
