Which of the following statements is incorrect when preserving digital evidence?

Question

Options

• ADocument the actions and changes that you observe in the monitor, computer, printer, or in other
• BVerily if the monitor is in on, off, or in sleep mode
• CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep
• DTurn on the computer and extract Windows event viewer log files

• A
  2% (1)
• B
  2% (1)
• D
  95% (41)

Explanation

Turning on a powered-off computer is a critical mistake in digital forensics because booting the system modifies timestamps, overwrites temporary files, clears volatile memory, and can alter or destroy evidence. Proper procedure requires documenting the current state of the monitor and device, and handling power based on the observed power state - never powering on a device that is off. Extracting Windows Event Viewer logs by turning on the computer violates evidence integrity principles.

No community discussion yet for this question.