Aaron, a digital first responder, is dispatched to an R & D laboratory after a suspected insider data breach involving intellectual property theft. Upon entering the laboratory, he observes several potential evidence artifacts: fingerprint smudges on the workstation keyboard, oily residue on a DVD near the printer, and an unplugged USB drive sitting on the desk. Realizing the risk of contaminating these artifacts, Aaron takes extra precautions. He documents the position of each item, uses evidence tags and gloves, and carefully covers the surfaces with protective barriers to prevent smearing or accidental contact before secure transportation. He also restricts access to the area until further forensic processing is completed. No devices are powered off or disconnected because his immediate focus is protecting physical trace evidence that could link the incident to a specific individual. Which best practice is Aaron demonstrating?
Submit