When a device is powered on, which action helps preserve digital evidence?

• A. Shut it off and disconnect power
• B. Reboot the device
• C. Remove from network access
• D. Install updated software

Answer: (C)

Keeping the device isolated from networks is essential for preserving digital evidence. When a device is connected, it can be remotely accessed, commands can be issued, or software could auto-update or wipe data, all of which can alter the evidence you need to analyze. Removing network access prevents these external interactions, helping you capture the device in its current state and create a reliable forensic image and record of logs. Other actions can change evidence: powering off may erase or alter volatile memory and system state; rebooting changes running processes and timestamps; installing updates alters files and configurations. So, removing from network access best maintains the integrity and state of the device for later examination.