Multiple Choice
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
A) Record nothing to avoid inaccuracies that might jeopardize the use of the evidence.
B) Record the location that the computer was recovered from.
C) Record the identity of the person(s) involved in the seizure.
D) Record the date and time the computer was seized.
Correct Answer:

Verified
Correct Answer:
Verified
Q51: The following keyword was typed in exactly
Q52: Temp files created by EnCase are deleted
Q53: Assume that MyNote.txt has been deleted. The
Q54: You are investigating a case involving fraud.
Q55: Within EnCase, you highlight a range of
Q57: Search terms are stored in what .ini
Q58: Within EnCase, what is the purpose of
Q59: A suspect typed a file on his
Q60: Which of the following statements is more
Q61: A SCSI host adapter would most likely