If a computer is on when you arrive at a scene, what does the Secret Service recommend you do?

If a computer is on when you arrive at a scene, what does the Secret Service recommend you do?

• A. Shut the computer down according to the recommended Secret Service procedure.
• B. Disconnect the power immediately and remove the hard drive.
• C. Leave it running to preserve current state.
• D. Restart the computer in safe mode before imaging

Answer: (A)

Preserving evidence integrity and a defensible chain of custody is the focus. When a computer is on upon arrival, the recommended action is to shut it down using the Secret Service procedure. Doing this in a documented, controlled way minimizes the chance of inadvertently altering data, running processes, or logs in a way that could compromise the investigation. It also sets up a clean state for later imaging with proper write-blocking and proven handling of the evidence. Turning off power abruptly or removing the hard drive outright risks corrupting data structures, overwriting or erasing artifacts, and undermining the integrity of the collection. Leaving the system running leaves volatile memory and live processes exposed, meaning important evidence could be lost or altered before you can capture it. Restarting in safe mode changes the boot state and can modify timestamps and other artifacts, reducing the defensibility of the image.

Preserving evidence integrity and a defensible chain of custody is the focus. When a computer is on upon arrival, the recommended action is to shut it down using the Secret Service procedure. Doing this in a documented, controlled way minimizes the chance of inadvertently altering data, running processes, or logs in a way that could compromise the investigation. It also sets up a clean state for later imaging with proper write-blocking and proven handling of the evidence.

Turning off power abruptly or removing the hard drive outright risks corrupting data structures, overwriting or erasing artifacts, and undermining the integrity of the collection. Leaving the system running leaves volatile memory and live processes exposed, meaning important evidence could be lost or altered before you can capture it. Restarting in safe mode changes the boot state and can modify timestamps and other artifacts, reducing the defensibility of the image.