ECCouncil 212-89 Question Answer
An organization suffers a financial loss after an executive responds to a fraudulent email crafted as part of a spear phishing attack. After isolating affected systems and notifying internal stakeholders, the incident response team prepares a detailed report outlining the attack timeline, suspicious IP addresses, email metadata, phone scam details, and the amount lost. This report is forwarded to a government agency specializing in cybercrime to aid further investigation and potential restitution. Which aspect of the recovery process is the organization addressing?

