Which rule remains unchanged in every computer investigation?
A) encrypt all notes
B) search every single file
C) pull the battery
D) document

Question

Quizplus · Accepted Answer

The rule that remains unchanged in every computer investigation is to document everything. It is essential to create a detailed and accurate record of all actions taken during the investigation. This includes the methods used, the evidence obtained, and the procedures followed. Failure to document every step could lead to the case being dismissed or critical evidence being deemed inadmissible in court. Encrypting notes and searching every single file may be necessary in some investigations, but are not universal rules. Pulling the battery is not recommended as it could cause data loss and potentially damage the device.

Which Rule Remains Unchanged in Every Computer Investigation