What method of copying should always be performed first before carrying out an investigation?

Which is a standard procedure to perform during all computer forensics investigations?

John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf John is working as a computer forensics investigator for a consulting firm in Canada. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server.
John decides to scan the virtual memory of the computer to possibly find something he had missed.

What information will the virtual memory scan produce?

What technique is used by JPEGs for compression?

Lockdown device uses which operating system to write hard drive data?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled.

Where could the investigator search to find the message tracking log file on the Exchange server?

Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers hideout.
Paul then comes across a PDA left by them that is attached to a number of different peripheral devices.

What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

What must be obtained before an investigation is carried out at a location?

How many times can data be written to a DVD+R disk?

What is the CIDR from the following screenshot?