(Choose 1 answer)
☐ A
✓ C
☐ D
Back
Next
☐
FUO.the
the exam.
Which of the following statements is incorrect when preserving digital evidence?
A. Document the actions and changes that you observe in the monitor, computer, printer, or in other
peripherals
B. Verily if the monitor is in on, off, or in sleep mode
C. Remove the power cable depending on the power state of the computer i.e., in on-off, or in sleep mode
D. Turn on the computer and extract Windows event viewer log files
