As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?
A)The power cable should be pulled.
B)The system should be shut down gracefully.
C)The power should be left on.
D)The decision should be left to the Digital Evidence First Responder (DEFR).

Question

​As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?
A)​The power cable should be pulled.
B)​The system should be shut down gracefully.
C)The power should be left on.
D)The decision should be left to the Digital Evidence First Responder (DEFR).

Quizplus · Accepted Answer

The decision on how to handle a seized computer that is powered on should be left to the Digital Evidence First Responder (DEFR) because they are trained to assess the situation and decide the best course of action to preserve evidence without causing data loss or corruption.

​As a General Rule, What Should Be Done by Forensics

As a General Rule, What Should Be Done by Forensics