Computer Hacking Forensic Investigator (CHFI v10) — Question 578

Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

Answer options

• A. Place PDA, including all devices, in an antistatic bag
• B. Unplug all connected devices
• C. Power off all devices if currently on
• D. Photograph and document the peripheral devices

Correct answer: D

Explanation

The correct answer is D because documenting and photographing the peripheral devices ensures that there is a visual and written record of the evidence before any changes or disconnections occur. Options A, B, and C all involve altering the state of the devices, which could compromise the integrity of the evidence.