Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?

The correct answer is D. At the time of seizing process, you need to shut down the computer immediately. Statement D is incorrect. Immediately shutting down a computer during evidence seizure is poor forensic practice because it destroys volatile evidence stored in RAM (running processes, open network connections, encryption keys, etc.). Proper digital forensics procedure requires c

Submitted by minji_kr· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ASample banners are used to record the system activities when used by the unauthorized user
BIn warning banners, organizations give clear and unequivocal notice to intruders that by signing
CThe equipment is seized which is connected to the case, knowing the role of the computer which
DAt the time of seizing process, you need to shut down the computer immediately

How the community answered

(66 responses)

A
6% (4)
B
5% (3)
C
2% (1)
D
88% (58)

Explanation

Statement D is incorrect. Immediately shutting down a computer during evidence seizure is poor forensic practice because it destroys volatile evidence stored in RAM (running processes, open network connections, encryption keys, etc.). Proper digital forensics procedure requires capturing volatile data first before powering down. Statements A, B, and C describe valid forensic practices: using sample/warning banners to document unauthorized access and seizing equipment relevant to the case.

Topics

#Electronic Evidence Acquisition#Crime Scene Procedures#Volatile Data#Live System Forensics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice