Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?
A.
When taking a computer for examination, if the computer is off. it should remain off when it is removed.
B.
When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.
C.
Before removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.
D.
When seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers
“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”
Thus,B is the least accurate statement.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit