Question

When collecting evidence from a running computer and its connected devices, what is the most important rule that should guide your actions? Write your answer in 1-2 sentences.

(2 points)

Answer 1

Preserve the integrity and authenticity of the evidence above all: do not alter original media, document every action and maintain chain of custody, and use forensically sound methods (capture volatile memory first) to minimize changes.