In the context of digital forensics, policy A is the most relevant. It defines which data should be logged, where logs should be forwarded for analysis or storage, and which logs should be archived for future forensic analysis or audit purposes. This ensures that evidence is preserved in a way that supports forensic activities.
[Reference: Guidance on this is provided in the ISO/IEC 27037 standard - Guidelines for identification, collection, acquisition, and preservation of digital evidence., ]
Submit