Q30
Single choice
An analyst needs to understand how an attacker compromised a server.
Which of the following procedures will best deliver the information that is necessary to reconstruct the steps taken by the attacker?