When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on

The correct answer is B. False. This statement is FALSE. A powered-off computer should NOT be turned on. Booting a system can alter file access timestamps, overwrite swap space, run startup scripts, clear or overwrite data, and generally change the state of the evidence. The correct procedure for a…

Submitted by emma.c· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ATrue
BFalse

How the community answered

(38 responses)

A
11% (4)
B
89% (34)

Explanation

This statement is FALSE. A powered-off computer should NOT be turned on. Booting a system can alter file access timestamps, overwrite swap space, run startup scripts, clear or overwrite data, and generally change the state of the evidence. The correct procedure for a powered-off computer is to leave it off, document its state, and perform a forensic acquisition using write-blockers and imaging tools without booting the original OS. Turning on a powered-off computer is one of the most common ways to inadvertently destroy or contaminate digital evidence.

Topics

#Crime scene procedures#Evidence handling#Digital forensics best practices#Volatile data preservation

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice