312-49 · Question #238
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
The correct answer is A. Keep the device powered on. PDAs and mobile devices store volatile data (RAM contents, running processes, unsaved data, encryption keys) that is lost the moment power is removed. If a device is already powered on when seized, the correct forensic procedure is to keep it powered on and, if possible, place…
Question
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
Options
- AKeep the device powered on
- BTurn off the device immediately
- CRemove the battery immediately
- DRemove any memory cards immediately
How the community answered
(33 responses)- A94% (31)
- C3% (1)
- D3% (1)
Explanation
PDAs and mobile devices store volatile data (RAM contents, running processes, unsaved data, encryption keys) that is lost the moment power is removed. If a device is already powered on when seized, the correct forensic procedure is to keep it powered on and, if possible, place it in a Faraday bag to block network signals (preventing remote wipe). Turning it off, removing the battery, or removing memory cards risks destroying volatile evidence. The goal is to preserve the device's current state for forensic imaging and analysis.
Topics
Community Discussion
No community discussion yet for this question.