Which of the following statements is incorrect when preserving digital evidence?

The correct answer is B. Turn on the computer and extract Windows event viewer log files. Turning on the computer and extracting Windows Event Viewer log files is incorrect practice when preserving digital evidence. Powering on a system changes volatile data, modifies timestamps, writes to the disk, and can alter or destroy evidence - violating the principle of eviden

Submitted by dimitri_ru· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AVerify if the monitor is in on, off, or in sleep mode
BTurn on the computer and extract Windows event viewer log files
CRemove the plug from the power router or modem
DDocument the actions and changes that you observe in the monitor, computer, printer, or in other

How the community answered

(60 responses)

A
2% (1)
B
93% (56)
C
3% (2)
D
2% (1)

Explanation

Turning on the computer and extracting Windows Event Viewer log files is incorrect practice when preserving digital evidence. Powering on a system changes volatile data, modifies timestamps, writes to the disk, and can alter or destroy evidence - violating the principle of evidence integrity. Proper forensic procedure requires preserving the system in its current state (on or off), documenting what is observed on the screen without interaction, and creating a forensic image before any extraction. The other options - checking monitor state, removing network connectivity, and documenting observations - are all valid preservation steps.

Topics

#Digital Evidence Preservation#Forensic Investigation Steps#First Responder#Volatile Data Handling

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice