Which statement best describes the status of evidence handling if the computer is on arrival and the procedure is followed?

• A. Shut down immediately using the recommended procedure
• B. Allowing unrestricted access to the device
• C. Proceed without logging any details
• D. Ignore the device and focus on other evidence

Answer: (A)

When evidence handling is done correctly, the first priority is to preserve the device in a known, reproducible state while preventing unauthorized access. Following a documented procedure ensures chain-of-custody and data integrity, including how the device is isolated and prepared for imaging. Shutting the computer down using the recommended procedure minimizes further data modification, stops running processes that could alter the disk, and creates a stable baseline for imaging and verification (hashes, logs, timestamps). This approach retains the evidentiary value by making the state of the device on arrival auditable and repeatable. Allowing unrestricted access, skipping logs, or ignoring the device would compromise integrity, traceability, and the ability to validate findings later.