When handling evidence, which of the following is not a common guideline?

Question

Options

• ARemove all suspects away from the computer crime scene.
• BContact your local law enforcement immediately
• CDocument the crime scene.
• DOne must have legal authority to seize and collect the evidence.

• A
  11% (6)
• B
  80% (45)
• C
  7% (4)
• D
  2% (1)

Explanation

Option B is not a standard evidence-handling guideline because immediately contacting local law enforcement is not always the appropriate first action - computer crime investigations often require specialized cybercrime units, federal agencies (like the FBI), or internal incident response teams rather than general local law enforcement, and premature notification can disrupt proper procedures.

Option A is a legitimate guideline: removing suspects prevents them from tampering with, destroying, or accessing digital evidence. Option C is also a core guideline, as thorough documentation (photos, notes, chain of custody) is essential to preserve evidence integrity and support prosecution. Option D reflects a fundamental legal principle - collecting evidence without proper authority (a warrant or legal jurisdiction) renders it inadmissible and may expose investigators to liability.

Memory tip: Think of the acronym D-S-L - Document, Secure (remove suspects), Legal authority - as the three pillars of evidence handling. Notifying law enforcement is a step that follows proper scene control, and the type of agency matters, making B the outlier.

No community discussion yet for this question.