(Choose 1 answer)
You are a computer forensic examiner at a scene and have determined you will seize a Linux server, which according to your source of information contains the database records for the company under investigation for fraud. The best practice for "taking down" the server for collection is to photograph the screen, note any running programs or messages and so on, and
A. Use the normal shutdown procedure
B. Pull the plug from the wall
C. Pull the plug from the rear of the computer
D. Ask the user at the scene to shut down the server
E. None of the other choices
E13
