312-49 · Question #173
Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to i
The correct answer is D. Photograph and document the peripheral devices. In digital forensics, documentation always comes first. Before touching, moving, or altering anything, the investigator must photograph and document the scene exactly as found. This preserves the evidentiary chain of custody and provides a record of the original state of the devi
Question
Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers?hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?
Options
- APlace PDA, including all devices, in an antistatic bag
- BUnplug all connected devices
- CPower off all devices if currently on
- DPhotograph and document the peripheral devices
How the community answered
(53 responses)- A4% (2)
- B11% (6)
- C6% (3)
- D79% (42)
Explanation
In digital forensics, documentation always comes first. Before touching, moving, or altering anything, the investigator must photograph and document the scene exactly as found. This preserves the evidentiary chain of custody and provides a record of the original state of the device and its connections. Powering off, unplugging, or bagging the device before documenting could undermine the integrity of the evidence in court.
Topics
Community Discussion
No community discussion yet for this question.