Câu 19: CFE - Investigation: Certified Fraud Examiner - Investigation

Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?

1. A. Before removing a computer system from a scene for further analysis, it is important to document the system’s setup with photographs or diagrams.
2. B. When taking a computer for examination, if the computer is off, it should remain off when it is removed.
3. C. When seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.
4. D. When seizing a computer for examination, the seizing party should look around the area for passwords because many people leave passwords near their computers. — đáp án hiện tại