What does SIFT stand for?

• A. Stop, Investigate, Trace, Find
• B. Stop, Investigate, Find, Trace
• C. Stop, Inspect, Find, Trace
• D. Stop, Investigate, Find, Track

Answer: (B)

SIFT is a mnemonic for guiding an incident response or digital-forensics workflow: Stop, Investigate, Find, Trace. The first step is Stop, which is about halting activity to preserve evidence and prevent further damage. Next comes Investigate, where you assess what happened, what systems were affected, and the scope of the incident. Then Find focuses on locating the relevant artifacts—logs, files, memory, and other data—that will support the analysis. The final step, Trace, is about reconstructing the sequence of events and identifying the source or path of the incident.

This order matters because you need to secure and understand the situation before you seek out and collect evidence, and only after gathering key artifacts should you work on tracing their origins or the attack path. The other options mix up the verbs or the sequence (for example, placing Trace before Find, or replacing Investigate with Inspect and Track with Trace), so they don’t align with the established mnemonic.