Certified Incident Handler (ECIH) — Question 48

Shawn, a forensic officer, was appointed to investigate a crime scene that had occurred at a coffee shop. As a part of investigation, Shawn collected the mobile device from the victim, which may contain potential evidence to identify the culprits.
Which of the following points must Shawn follow while preserving the digital evidence? (Choose three.)

Answer options

• A. Never record the screen display of the device
• B. Turn the device ON if it is OFF
• C. Do not leave the device as it is if it is ON
• D. Make sure that the device is charged

Correct answer: B, C, D

Explanation

The correct answers are B, C, and D because turning on a device that is off is necessary to access data, and it is important to not leave a powered-on device unattended as it may alter the evidence. Additionally, ensuring the device is charged is crucial for further examination. Option A is incorrect since documenting the screen can be essential for evidence collection.