In evidence collection, why should you note all cable connections for a seized computer?

• A. To know what outside connections existed
• B. In case other devices were connected
• C. To know what peripheral devices exist
• D. To know what hardware existed

Answer: (A)

Documenting all cable connections reveals what external links were active with the computer at the time of seizure. This helps you understand how the machine was interfacing with the outside world—such as networks, storage, or other devices—and is crucial for reconstructing the environment and possible data paths during analysis. By noting these connections, you can trace how data could have flowed in or out and identify potential points of compromise or collaboration with other systems.

While noting other devices connected and knowing peripheral devices exist are related, they’re narrower. Some connections may be to a network or to external storage that aren’t obvious as “peripherals.” Saying what outside connections existed captures the full context of how the machine interacted with its surroundings, which is essential for accurate forensic reconstruction. Knowing only hardware existed is too vague to explain how communication or data transfer occurred.