When a monitor is powered on but the display is blank at a crime scene, what is the recommended action?

When a monitor is powered on but the display is blank at a crime scene, what is the recommended action?

• A. Move the mouse slowly without clicking and photograph the screen
• B. Press any key to wake the display and take a photo
• C. Move the mouse quickly to trigger a screen saver and take a photo
• D. Power off the computer and capture a memory image

Answer: (A)

When a monitor is blank, the priority is to reveal and document the current screen state without introducing new data or altering the system. Gently moving the mouse is usually enough to wake the display without sending keystrokes or triggering actions that could change what appears on the screen. Once the screen is visible, photograph it to capture the exact evidence as shown. Pressing a key or moving the mouse in a rapid, aggressive way could trigger login prompts, unlock the system, start programs, or change what’s displayed, which would contaminate the evidence. Powering off the computer would destroy volatile memory and other transient evidence, so it’s not the correct initial action. If the screen doesn’t wake after a gentle touch, follow the established forensic procedures to document and proceed without altering the system state.

When a monitor is blank, the priority is to reveal and document the current screen state without introducing new data or altering the system. Gently moving the mouse is usually enough to wake the display without sending keystrokes or triggering actions that could change what appears on the screen. Once the screen is visible, photograph it to capture the exact evidence as shown.

Pressing a key or moving the mouse in a rapid, aggressive way could trigger login prompts, unlock the system, start programs, or change what’s displayed, which would contaminate the evidence. Powering off the computer would destroy volatile memory and other transient evidence, so it’s not the correct initial action. If the screen doesn’t wake after a gentle touch, follow the established forensic procedures to document and proceed without altering the system state.