Which step should you take first when handling a PDA found during a hacking ring investigation?

Which step should you take first when handling a PDA found during a hacking ring investigation?

• A. Photograph and document peripheral devices
• B. Place PDA in antistatic bag
• C. Unplug all connections
• D. Power off devices

Answer: (A)

The step being tested is the practice of preserving evidence by first capturing an objective record of the device and its connections. Photographing and documenting the PDA and any peripheral devices creates a baseline of exactly how the device appeared when found—the model, serial numbers, cables, ports, power state, screen status, and surrounding context. This record is essential for later analysis and for maintaining a solid chain of custody, because it prevents uncertainty about how the device was located and what was connected at the moment of seizure. Why this is the best first move: once you have a precise, unaltered record, you can move forward with preservation steps with confidence, knowing you didn’t rely on memory or assumptions. Other actions, like unplugging cables or powering the device down, can change data or remove volatile information and should only be performed after the initial documentation to avoid compromising the evidence. Placing the PDA in an antistatic bag is important for protection, but it comes after you’ve documented the scene so you have a factual reference of the original state.

The step being tested is the practice of preserving evidence by first capturing an objective record of the device and its connections. Photographing and documenting the PDA and any peripheral devices creates a baseline of exactly how the device appeared when found—the model, serial numbers, cables, ports, power state, screen status, and surrounding context. This record is essential for later analysis and for maintaining a solid chain of custody, because it prevents uncertainty about how the device was located and what was connected at the moment of seizure.

Why this is the best first move: once you have a precise, unaltered record, you can move forward with preservation steps with confidence, knowing you didn’t rely on memory or assumptions. Other actions, like unplugging cables or powering the device down, can change data or remove volatile information and should only be performed after the initial documentation to avoid compromising the evidence. Placing the PDA in an antistatic bag is important for protection, but it comes after you’ve documented the scene so you have a factual reference of the original state.