What Should Be the FIRST Action to Protect the Chain

question 122

Multiple Choice

What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

• A) Take the computer to a forensic lab
• B) Make a copy of the hard drive
• C) Start documenting
• D) Turn off the computer