During which phase of the incident response process is evidence most likely gathered to support legal action?

• A. The Detection and Analysis phase
• B. The Containment, Eradication, and Recovery phase
• C. The Preparation phase
• D. The Post-Incident Review phase

Answer: (B)

Collecting and preserving evidence for legal action hinges on maintaining chain of custody and minimizing changes to evidence while you actively neutralize the threat. This balance is achieved in the Containment, Eradication, and Recovery phase, when responders isolate affected systems, remove the attacker’s access, and begin restoring operations. In this phase you can systematically acquire forensic artifacts—disk images, volatile memory, log files, and network traffic data—while documenting every action to support potential legal proceedings. You also coordinate with legal or law enforcement to ensure evidence handling meets evidentiary standards. The Detection and Analysis phase centers on identifying and understanding what happened and the scope, not on preserving evidence for court. The Preparation phase focuses on readiness and policies, and the Post-Incident Review phase emphasizes lessons learned and improvements rather than gathering material for legal action.