A user's computer is suspected of hosting illegal files. The IT department has removed the computer and placed it in a secured, cypher-locked room, where it will remain until the local authorities…

The correct answer is A. Preserve data integrity. The computer has already been physically secured (chain of custody is established). The next priority is to preserve data integrity - ensuring that the contents of the drive are not altered, modified, or corrupted before law enforcement arrives. This may involve documenting the…

Hardware

Question

A user's computer is suspected of hosting illegal files. The IT department has removed the computer and placed it in a secured, cypher-locked room, where it will remain until the local authorities arrive. Which of the following actions should the IT department perform NEXT?

Options

APreserve data integrity
BIdentify violations of acceptable use
CCollect evidence of illegal activity
DReport through proper channels

How the community answered

(33 responses)

A
58% (19)
B
6% (2)
C
21% (7)
D
15% (5)

Explanation

The computer has already been physically secured (chain of custody is established). The next priority is to preserve data integrity - ensuring that the contents of the drive are not altered, modified, or corrupted before law enforcement arrives. This may involve documenting the current state, avoiding powering the system on, or creating a forensic image. Collecting evidence or identifying AUP violations should only be done by authorized investigators (typically law enforcement), not IT staff, to avoid tainting the evidence. Reporting through proper channels is important but the immediate technical concern is ensuring the evidence remains intact.

Topics

#chain of custody#digital forensics#data integrity#incident response

Community Discussion

No community discussion yet for this question.

Full 220-1002 Practice