During a hacking ring investigation, you recover a PDA attached to several peripherals. What is the first step to preserve the integrity of the evidence?

During a hacking ring investigation, you recover a PDA attached to several peripherals. What is the first step to preserve the integrity of the evidence?

• A. Photograph and document the peripheral devices
• B. Place PDA, including all devices, in an antistatic bag
• C. Unplug all connected devices
• D. Power off all devices if currently on

Answer: (A)

Capturing and documenting the exact state of the PDA and its peripherals at the scene creates a verifiable baseline that preserves how the evidence appeared and was connected when found. Photographs from multiple angles, close-ups of ports and cables, and detailed notes establish the chain of custody and allow later analysts to understand the original setup without relying on memory. This nonintrusive step prevents accidental changes to the evidence and provides a reference for every subsequent action. Handling steps like placing devices in an antistatic bag, unplugging connections, or powering down can alter the data or configuration. Those actions should come after documenting the scene to ensure the original state is preserved for analysis.

Capturing and documenting the exact state of the PDA and its peripherals at the scene creates a verifiable baseline that preserves how the evidence appeared and was connected when found. Photographs from multiple angles, close-ups of ports and cables, and detailed notes establish the chain of custody and allow later analysts to understand the original setup without relying on memory. This nonintrusive step prevents accidental changes to the evidence and provides a reference for every subsequent action.

Handling steps like placing devices in an antistatic bag, unplugging connections, or powering down can alter the data or configuration. Those actions should come after documenting the scene to ensure the original state is preserved for analysis.