Certified Incident Handler (CIH) Practice Ecam

What mistake is often made by a first responder at the crime scene?

1. Taking photographs of the scene

2. Rebooting the victim's computer

3. Not securing the scene first

4. Collecting evidence without gloves

The correct answer is: Rebooting the victim's computer

The choice of rebooting the victim's computer is a significant mistake that first responders can make at a crime scene. When a computer is rebooted, it can lead to the loss of volatile data that is crucial for any investigation. This data includes unsaved documents, open applications, and even running processes, which might provide essential evidence or insights into the circumstances of the crime. Additionally, rebooting may also alter timestamps and modify the state of the system, complicating forensic analysis and potentially hindering the investigation. Preserving the integrity of the evidence should always be prioritized, and interacting with a compromised device in this way can severely undermine the forensic process. Other choices highlight important practices in evidence handling, such as securing the scene first or using gloves to prevent contamination, which are critical for maintaining the integrity of the investigation and protecting any potential evidence from being tampered with.