When Performing a Static Acquisition, What Should Be Done After

question 14

Multiple Choice

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

• A)​Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
• B)​Start the suspect's computer and begin collecting evidence.
• C) The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.​
• D)Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.