What is the First Step required in preparing a computer for forensics investigation?

The correct answer is A. Do not turn the computer off or on, run any programs, or attempt to access data on a computer. The very first step in any forensic investigation is to avoid altering the state of the evidence. Turning the computer on or off, running programs, or accessing data can overwrite volatile memory, modify file timestamps, create new files, or destroy evidence. This principle…

Submitted by ashley.k· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ADo not turn the computer off or on, run any programs, or attempt to access data on a computer
BSecure any relevant media
CSuspend automated document destruction and recycling policies that may pertain to any relevant
DIdentify the type of data you are seeking, the Information you are looking for, and the urgency

How the community answered

(23 responses)

A
91% (21)
B
4% (1)
C
4% (1)

Explanation

The very first step in any forensic investigation is to avoid altering the state of the evidence. Turning the computer on or off, running programs, or accessing data can overwrite volatile memory, modify file timestamps, create new files, or destroy evidence. This principle - 'do not disturb' - preserves the integrity of the original evidence and ensures admissibility in court. All other steps (securing media, suspending destruction policies, identifying what to look for) are important but come after ensuring the scene is not disturbed.

Topics

#Evidence preservation#First responder actions#Digital evidence handling

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice