Which action is NOT recommended when preserving evidence?

Which action is NOT recommended when preserving evidence?

• A. Document the actions observed in the monitor and peripherals
• B. Verify the monitor power state (on, off, or sleep)
• C. Remove the power cable depending on the power state
• D. Turn on the computer and extract Windows event viewer log files

Answer: (D)

Preserving evidence means keeping the system and its data as close to the original state as possible, so any action that could change data, timestamps, or the state of files is avoided unless absolutely necessary and properly documented. Turning on the computer to extract Windows event viewer log files is not recommended because booting or powering up a device can modify volatile data, trigger startup processes, and create new log entries that weren’t there before. This can alter the evidence and complicate the reconstruction of what actually happened. Accessing logs after the fact on a live machine risks contaminating the data and undermining the integrity of the investigation. Documenting what you observe on the monitor and peripherals is a safe first step, as it records the current state without changing anything. Verifying the monitor’s power state helps you establish the baseline condition of the display, which is important for interpreting what you’ll or won’t be able to see or extract. Removing the power cable, when done with a proper, controlled procedure and where appropriate (for example, when the device is already powered down or when your policy allows it with safeguards), can be part of preserving evidence by preventing further activity. In contrast, turning the system on to grab logs introduces changes, so that action is avoided.

Preserving evidence means keeping the system and its data as close to the original state as possible, so any action that could change data, timestamps, or the state of files is avoided unless absolutely necessary and properly documented.

Turning on the computer to extract Windows event viewer log files is not recommended because booting or powering up a device can modify volatile data, trigger startup processes, and create new log entries that weren’t there before. This can alter the evidence and complicate the reconstruction of what actually happened. Accessing logs after the fact on a live machine risks contaminating the data and undermining the integrity of the investigation.

Documenting what you observe on the monitor and peripherals is a safe first step, as it records the current state without changing anything. Verifying the monitor’s power state helps you establish the baseline condition of the display, which is important for interpreting what you’ll or won’t be able to see or extract. Removing the power cable, when done with a proper, controlled procedure and where appropriate (for example, when the device is already powered down or when your policy allows it with safeguards), can be part of preserving evidence by preventing further activity. In contrast, turning the system on to grab logs introduces changes, so that action is avoided.