nerdexam
EC-Council

212-82 · Question #137

You've been called in as a computer forensics investigator to handle a case involving a missing company laptop from the accounting department, which contained sensitive financial data. The company…

The correct answer is D. Secure the scene where the laptop was last seen (if possible). As a computer forensics investigator handling a missing laptop with sensitive data, the most critical initial action is to secure the scene where the laptop was last seen to preserve potential evidence.

Submitted by obi.ng· Mar 6, 2026Cloud Security Operations & Incident Response

Question

You've been called in as a computer forensics investigator to handle a case involving a missing company laptop from the accounting department, which contained sensitive financial data. The company suspects a potential data breach and wants to recover any evidence from the missing device. What is your MOST important initial action regarding the digital evidence?

Options

  • ATurn on the laptop (if found) and search for deleted files.
  • BInterview company personnel to understand the missing laptop's usage.
  • CReport the incident to law enforcement immediately.
  • DSecure the scene where the laptop was last seen (if possible).

How the community answered

(48 responses)
  • A
    15% (7)
  • B
    2% (1)
  • C
    6% (3)
  • D
    77% (37)

Why each option

As a computer forensics investigator handling a missing laptop with sensitive data, the most critical initial action is to secure the scene where the laptop was last seen to preserve potential evidence.

ATurn on the laptop (if found) and search for deleted files.

Turning on a device can alter volatile data, timestamps, and system logs, thereby contaminating potential evidence before proper forensic imaging and analysis can be conducted.

BInterview company personnel to understand the missing laptop's usage.

While interviewing personnel provides valuable context, it is a secondary step after initial evidence preservation to ensure that no actions are taken that could inadvertently destroy or corrupt digital evidence.

CReport the incident to law enforcement immediately.

Reporting to law enforcement is a crucial legal and procedural step, but the immediate 'initial action regarding the digital evidence' itself involves physically securing the environment to protect the evidence.

DSecure the scene where the laptop was last seen (if possible).Correct

Securing the scene is paramount in digital forensics to preserve the integrity of potential evidence, prevent further alteration or contamination, and establish a clear chain of custody from the very beginning of the investigation.

Concept tested: Digital forensics initial response; Evidence preservation

Source: learn.microsoft.com/en-us/security/compass/incident-response-technical-guidance#prepare-for-an-incident

Topics

#Digital forensics#Incident response#Evidence preservation#Chain of custody

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 212-82 Practice