Why should you note all cable connections for a computer you intend to seize as evidence?

• A. To document the network topology for later replication
• B. In case other devices were connected
• C. To determine the cable manufacturer
• D. To identify the type of connectors used

Answer: (B)

During a seizure, recording every cable connected to the computer preserves the surrounding context of the evidence. Knowing what other devices were directly or indirectly linked to the machine helps you understand what data could have been transmitted, shared, or interacted with the system. This matters because network or peripheral connections can influence artifacts you’ll find, such as network shares, log entries, recently accessed files, or mounted drives. If you don’t document these connections, you risk missing critical interactions that explain how the system was used and what evidence it may contain.

While details like cable manufacturers or connector types aren’t as essential to the immediate reconstruction of events, noting all active connections at seizure time is the best way to ensure you can recreate the environment during analysis and maintain the integrity of the investigation.