| Exam 200-201 | Question id=6061 | Host-based analysis |
During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?
| A. |
examination | |
| B. |
investigation | |
| C. |
collection | |
| D. |
reporting |