Exam CISA topic 1 question 1447 discussion

Unplugging the computer from its power source could potentially disrupt ongoing fraudulent activities or tamper with volatile evidence stored in system memory. While it may be necessary to disconnect the computer from the network to prevent further fraudulent activities, creating a forensic copy of the system should be prioritized to preserve the evidence. Therefore, option D, making a copy of the affected system, should be done FIRST to protect evidence on a computer suspected to be involved in online fraud.