When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?
A)Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
B)Start the suspect's computer and begin collecting evidence.
C) The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
D)Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.

Question

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​
A)​Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
B)​Start the suspect's computer and begin collecting evidence.
C) The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.​
D)Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.

Quizplus · Accepted Answer

After documenting the hardware on a suspect's computer, it is important to record the system's date and time values from the CMOS. Additionally, if practical, the hard drive should be removed to prevent any accidental modification to the data.

When Performing a Static Acquisition, What Should Be Done After