What is the first step required when preparing a computer for forensics investigation?

• A. Do not turn the computer off or on, run any programs, or attempt to access data on a computer
• B. Secure any relevant media
• C. Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue
• D. Identify the type of data you are seeking, the information you are looking for, and the urgency level of the examination

Answer: (A)

Preserving evidence in its original state is the priority. The moment you start interacting with the device—turning it on or off, running programs, or accessing data—you risk altering data, changing timestamps, overwriting memory, or otherwise contaminating the evidence. Keeping the computer untouched ensures the integrity of the data and supports a reliable chain of custody, making it possible to create an admissible forensic image later. After establishing this baseline, you would proceed with proper steps like securing the relevant media and documenting the scene, but those actions should follow the decision to avoid any modification of the system.