What is NOT Part of the Pre-Investigation Phase?

Computer Forensics Investigation Process

Which of the following is NOT a part of pre-investigation phase?

  1. Building forensics workstation
  2. Gathering information about the incident
  3. Gathering evidence data Correct Answer
  4. Creating an investigation team
Answer Correct answer: C — Gathering evidence data is an active investigative step, not a pre-investigation preparation task.

Community Votes

C
90%
A
10%

90% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the boundaries of the pre-investigation phase, where the common trap is confusing the active collection of evidence with the preliminary gathering of incident details.

The pre-investigation phase of a computer forensics investigation focuses entirely on preparation and planning. This page establishes that gathering evidence data occurs during the actual investigation phase, making it the correct answer for what is not a pre-investigation task.

Choosing B (Gathering information about the incident) because it sounds like evidence collection, but gathering initial incident details is a planning step, whereas gathering actual evidence data is an execution step.

Community Discussion (3 comments)

Cisco103 👍 1 Selected: C
pre- inves, C is investing
aqeel1506 👍 1
C. Gathering evidence data The pre-investigation phase typically involves preparing for the investigation and planning, which includes: Building forensics workstation: Setting up the necessary tools and environment for conducting forensic analysis. Gathering information about the incident: Collecting initial details and understanding the context of the incident. Creating an investigation team: Assembling the team responsible for conducting the investigation. Gathering evidence data is part of the actual investigation phase, not the pre-investigation phase.
Elb 👍 1
C > The pre-investigation phase deals with tasks that are to be completed before the investigation begins.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Gathering evidence data is an active step performed during the investigation phase, specifically during data acquisition, not before the investigation begins. The pre-investigation phase is strictly about readiness, preparation, and planning. Therefore, gathering evidence data does not belong to the pre-investigation phase.

Why the Other Options Are Wrong

Building a forensics workstation (Option A) is a classic preparation task completed before the investigation starts. Gathering information about the incident (Option B) refers to initial scoping and context gathering, which is part of planning. Creating an investigation team (Option D) is an organizational step that must occur before forensic analysis can proceed.

Community Comment Notes

Commenters correctly identified that the pre-investigation phase involves tasks completed before the analysis begins, as Elb noted, "tasks that are to be completed before the investigation begins." Aqeel1506 further clarified that this phase involves "preparing for the investigation and planning," which explicitly excludes the active collection of evidence.

Exam Strategy

Distinguish between preparatory steps (planning, team building, tool setup) and active investigative steps (acquisition, analysis, reporting). Any option involving actual evidence data handling is likely part of the investigation phase, not the pre-investigation phase.

Related Analysis

Which of the following Perl scripts will help an investigato

A-Grade

Maria has executed a suspicious executable file in a control

A-Grade

Robert needs to copy an OS disk snapshot of a compromised VM

A-Grade

← Back to 312-49v10 Study Guide