Exam 312-49v10 topic 1 question 59 discussion

A and C The first step in seizing evidence during the bag-and-tag process is to plug the network cable back into the computer. Next, all cables near there terminal end should be labeled and an identical label should be placed next to its corresponding port. Once all the cables and ports have been properly labeled, the forensic examiner should again photograph the back of the computer at several different angels. Taking these photographs will serve as proof for how the computer was configured at the scene. This documentation will be useful if the forensic examiner must later reconstruct the system. Once documented, all the cables connected to the computer should be removed.