What must an investigator do before disconnecting an iPod from any type of computer?

What must an investigator do before disconnecting an iPod from any type of computer?

• A. Join the iPod
• B. Unmount the iPod
• C. Disjoin the iPod
• D. Mount the iPod

Answer: (B)

Before disconnecting, you unmount (eject) the iPod. This tells the operating system to finish any pending read/write operations, flush caches, and close the file system properly. Doing so prevents data corruption on the device and preserves the integrity of the evidence, which is crucial for later imaging and analysis. In Windows or macOS, the same idea is achieved by an “eject” or “safely remove hardware” action. Mounting would reestablish access and could allow further writes, while joining or disjoining aren’t standard steps in this context.

Before disconnecting, you unmount (eject) the iPod. This tells the operating system to finish any pending read/write operations, flush caches, and close the file system properly. Doing so prevents data corruption on the device and preserves the integrity of the evidence, which is crucial for later imaging and analysis. In Windows or macOS, the same idea is achieved by an “eject” or “safely remove hardware” action. Mounting would reestablish access and could allow further writes, while joining or disjoining aren’t standard steps in this context.