Certified Incident Handler (CIH) Practice Ecam

What step must Martin follow when the suspected device is switched off?

1. Press any key on the keyboard

2. Move the mouse slightly, and if the screen does not change, do not press any keys

3. Force restart the device to access data

4. Remove the device from the main power source

The correct answer is: Move the mouse slightly, and if the screen does not change, do not press any keys

In the scenario where a suspected device is switched off, the appropriate step is to move the mouse slightly and observe the screen's response. This action allows the handler to determine whether the device is truly off or in a sleep or hibernation state. If the screen does not change after moving the mouse, it confirms that the device is indeed powered down, and no further action is required at that moment to assess the state of the device. This cautious approach is advantageous as it avoids unnecessary actions that might compromise potential evidence or data integrity. Pressing any key on the keyboard may not provide a clear indication of the state of the device and could potentially complicate the situation by changing its state. Additionally, forcing a restart could lead to irretrievable data loss or corruption, especially if the device contains sensitive or vital information that is being investigated. Removing the device from the main power source is typically a last resort to prevent further data loss, but it also risks losing volatile data if the device was still operational. Thus, moving the mouse and observing for any indication of activity is the most prudent initial step.