An IS auditor finds a computer that is suspected to have been involved in a cyber crime. Which of the following activities is MOST critical to ensure data collected is admissible in a court of law?
A.
Notify law enforcement upon detection.
B.
Track possession of the computer.
C.
Collect audit logs from the affected computer.
D.
Power off the computer to ensure data is not changed.
Should be A. Suspected crime means law enforcement must be notified. They will run the forensic procedures. Powering down the computer will delete "data in use".
It may be D.
Prioritizing the preservation of evidence by powering down the computer immediately ensures the data remains intact and maximizes its admissibility in court. It's important to emphasize the importance of following established forensic procedures and consulting with legal counsel to ensure proper handling and collection of digital evidence.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
blehbleh
3 weeks, 4 days agoPurpleParrot
2 months, 1 week agoa84n
6 months, 1 week agoa84n
6 months, 1 week agojoehong
7 months agomarc4354345
8 months, 3 weeks agoSibsankar
9 months agoRachy
9 months, 3 weeks ago