In mobile device forensics, if the display is on and you want to preserve evidence, you should:

In mobile device forensics, if the display is on and you want to preserve evidence, you should:

• A. Turn on Bluetooth and Wi-Fi radios
• B. Unplug the device from the computer
• C. Do not wear gloves
• D. If the display is on, photograph screen contents

Answer: (D)

When the device’s display is on, capturing a photograph of the screen preserves exactly what was being shown at that moment—including open apps, notifications, and timestamps—without changing anything on the device. This creates a reliable, non-invasive evidentiary record that can be reviewed later and used in analysis or legal proceedings, even if you need to interact with the device later. Turning on Bluetooth and Wi‑Fi could alter the device state or data by enabling network activity or connections, which risks contaminating the evidence. Unplugging from the computer might disrupt the forensic workflow or affect data transfer, and isn’t about preserving what’s displayed. Not wearing gloves relates to contamination control, not to preserving the visible evidence on the screen. Therefore, photographing the screen contents is the best approach to preserve what was visible.

When the device’s display is on, capturing a photograph of the screen preserves exactly what was being shown at that moment—including open apps, notifications, and timestamps—without changing anything on the device. This creates a reliable, non-invasive evidentiary record that can be reviewed later and used in analysis or legal proceedings, even if you need to interact with the device later.

Turning on Bluetooth and Wi‑Fi could alter the device state or data by enabling network activity or connections, which risks contaminating the evidence. Unplugging from the computer might disrupt the forensic workflow or affect data transfer, and isn’t about preserving what’s displayed. Not wearing gloves relates to contamination control, not to preserving the visible evidence on the screen. Therefore, photographing the screen contents is the best approach to preserve what was visible.