Which of the following is the most appropriate way to collect computer evidence?

Question

Quizplus · Accepted Answer

Unplugging the computer and transporting it to a secure lab for analysis is the most appropriate way to ensure the preservation of evidence and prevent any alteration or deletion of data. Labeling all cables and accessories ensures that the equipment can be correctly reassembled for analysis. Starting up or rebooting the computer could alter or delete data, and allowing an employee or homeowner to handle the computer could compromise the evidence chain of custody.

Which of the Following Is the Most Appropriate Way to Collect