Which term refers to the process of gathering evidence and identifying methods used in an incident or attack?

• A. Forensic investigation
• B. Grey-Hat hackers
• C. Grayware
• D. Hacker

Answer: (A)

Forensic investigation is the process of gathering evidence and identifying methods used in an incident or attack. In security, this means collecting and preserving digital artifacts such as logs, disk images, memory dumps, and network captures, then analyzing them to reconstruct what happened, when it happened, and which tools or techniques the attacker employed. It also involves maintaining chain of custody so the evidence remains admissible and following a structured workflow to map attacker TTPs (techniques, techniques, and procedures). This helps determine the attack vector, affected systems, and the scope, and supports any legal or compliance needs. The other terms refer to people or software rather than the investigative process: a hacker is a person who breaks into systems, and grey-hat hackers and grayware describe individuals or software that fall into less clear ethical or functional categories.