Which of the following statement is not correct when dealing with a powered-on computer at the crime scene?

The correct answer is D. If the computer is switched off. power on the computer to take screenshot of the desktop. A fundamental rule in computer forensics is to never power on a device that is switched off at a crime scene. Powering on the computer would alter timestamps, overwrite memory contents, modify registry entries, and potentially destroy volatile evidence - all of which compromise…

Submitted by thandi_sa· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AIf a computer is switched on and the screen is viewable, record the programs running on screen
BIf a computer is on and the monitor shows some picture or screen saver, move the mouse slowly
CIf a monitor is powered on and the display is blank, move the mouse slowly without depressing
DIf the computer is switched off. power on the computer to take screenshot of the desktop

How the community answered

(34 responses)

A
6% (2)
B
3% (1)
C
3% (1)
D
88% (30)

Explanation

A fundamental rule in computer forensics is to never power on a device that is switched off at a crime scene. Powering on the computer would alter timestamps, overwrite memory contents, modify registry entries, and potentially destroy volatile evidence - all of which compromise the integrity of the investigation. Options A, B, and C all describe accepted forensic procedures for handling a computer that is already on: documenting running programs, and gently moving the mouse (without clicking) to check whether a screen saver or blank display is active, without altering the system state.

Topics

#Crime scene procedures#Digital evidence collection#Volatile data#Forensic best practices

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice