When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on

The correct answer is B. False. This statement is FALSE. A powered-off computer should NOT be turned on. Booting a system can alter file access timestamps, overwrite swap space, run startup scripts, clear or overwrite data, and generally change the state of the evidence. The correct procedure for a powered-off

Submitted by emma.c· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ATrue
BFalse

How the community answered

(38 responses)

A
11% (4)
B
89% (34)

Explanation

This statement is FALSE. A powered-off computer should NOT be turned on. Booting a system can alter file access timestamps, overwrite swap space, run startup scripts, clear or overwrite data, and generally change the state of the evidence. The correct procedure for a powered-off computer is to leave it off, document its state, and perform a forensic acquisition using write-blockers and imaging tools without booting the original OS. Turning on a powered-off computer is one of the most common ways to inadvertently destroy or contaminate digital evidence.

Topics

#Crime scene procedures#Evidence handling#Digital forensics best practices#Volatile data preservation

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice