Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining

Question

Options

• ARecord the system state by taking photographs of physical system and the display
• BPerform data acquisition without disturbing the state of the systems
• COpen the systems, remove the hard disk and secure it
• DSwitch off the systems and carry them to the laboratory

• A
  91% (29)
• B
  3% (1)
• C
  6% (2)

Explanation

The first responder's primary obligation at a digital crime scene is to document the current state without altering evidence. Taking photographs of the physical hardware and active screen displays preserves volatile and visible evidence (such as running processes, open files, or on-screen data) before anything changes. Performing data acquisition (B), removing hard disks (C), or powering off systems (D) all risk altering or destroying volatile evidence and should only occur after thorough documentation. Proper sequencing - document first, then collect - is a core principle of digital forensics and chain-of-custody preservation.

No community discussion yet for this question.