After a computer forensics investigator seizes a computer during a crime investigation, what is the next step?
A.
Label and put it into a container, and then label the container.
B.
Dust the evidence for fingerprints.
C.
Make an image copy of the disks.
D.
Lock the evidence in the safe.
Explanation:
C: Several steps need to be followed when gathering and extracting evidence from a scene. Once a computer has been confiscated, the first thing the computer forensics team should do is make an image of the hard drive. The team will work from this image instead of the original hard drive so it stays in a pristine state and the evidence on the drive is not accidentally corrupted or modified.