What is NOT Part of the Pre-Investigation Phase?
Short answer
C Gathering evidence data is an active investigative step, not a pre-investigation preparation task.
Question
Key Takeaways
The question tests the boundaries of the pre-investigation phase, where the common trap is confusing the active collection of evidence with the preliminary gathering of incident details.
The pre-investigation phase of a computer forensics investigation focuses entirely on preparation and planning. This page establishes that gathering evidence data occurs during the actual investigation phase, making it the correct answer for what is not a pre-investigation task.
Common mistake: Choosing B (Gathering information about the incident) because it sounds like evidence collection, but gathering initial incident details is a planning step, whereas gathering actual evidence data is an execution step.
Expert Analysis
Why the Answer Is Correct
Gathering evidence data is an active step performed during the investigation phase, specifically during data acquisition, not before the investigation begins. The pre-investigation phase is strictly about readiness, preparation, and planning. Therefore, gathering evidence data does not belong to the pre-investigation phase.
Why the Other Options Are Wrong
Building a forensics workstation (Option A) is a classic preparation task completed before the investigation starts. Gathering information about the incident (Option B) refers to initial scoping and context gathering, which is part of planning. Creating an investigation team (Option D) is an organizational step that must occur before forensic analysis can proceed.
Community Comment Notes
Commenters correctly identified that the pre-investigation phase involves tasks completed before the analysis begins, as Elb noted, "tasks that are to be completed before the investigation begins." Aqeel1506 further clarified that this phase involves "preparing for the investigation and planning," which explicitly excludes the active collection of evidence.
Exam Strategy
Distinguish between preparatory steps (planning, team building, tool setup) and active investigative steps (acquisition, analysis, reporting). Any option involving actual evidence data handling is likely part of the investigation phase, not the pre-investigation phase.
Community Votes
90% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1C. Gathering evidence data The pre-investigation phase typically involves preparing for the investigation and planning, which includes: Building forensics workstation: Setting up the necessary tools and environment for conducting forensic analysis. Gathering information about the incident: Collecting initial details and understanding the context of the incident. Creating an investigation team: Assembling the team responsible for conducting the investigation. Gathering evidence data is part of the actual investigation phase, not the pre-investigation phase.
-
Elb 👍 1C > The pre-investigation phase deals with tasks that are to be completed before the investigation begins.
-
Cisco103 👍 1 Answered Cpre- inves, C is investing
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.