To which phase of the computer forensics investigation process does "planning and budgeting of a forensics lab" belong?

Which of the following attack uses HTML tags like <script></script>?

A cybersecurity investigator is analyzing a suspected dark web transaction involving illegal activities. However, the investigator struggles to find conclusive data due to Tor's onion routing and encryption. What is a specific feature of the Tor network that might help explain why the original source of this transaction is hard to trace?

Which root folder (hive) of registry editor contains a vast array of configuration information for the system, including hardware settings and software settings?

While working for a prosecutor, What do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense ?