Certified Incident Handler (CIH) Practice Ecam

Disable ads (and more) with a membership for a one time $2.99 payment

Prepare for the Certified Incident Handler (CIH) Exam. Enhance your knowledge with interactive quizzes and detailed insights into cyber incident handling. Boost your exam readiness with our expert-designed questions!

Each practice test/flash card set has 50 randomly selected questions from a bank of over 500. You'll get a new set of questions each time!

Practice this question and more.

Which of the following points should not be considered by first responders when documenting an electronic crime scene?

Record the state of the computer system
Document digital storage media
Capture errors displayed on devices
Do not record the state of the computer system

The correct answer is: Do not record the state of the computer system

First responders play a critical role in the documentation of an electronic crime scene, and it is essential for them to accurately capture all relevant information. Among the points that should be considered, understanding the state of the computer system is paramount. Recording this information helps to establish the condition the device was in at the time of the incident, which can be vital for forensic analysis and evidence consistency. In an electronic crime scene, documenting digital storage media allows responders to understand what information may have been stored or altered. Capturing any errors that are displayed on devices is equally important, as it may provide insight into the actions taken by the suspect or the potential impact of the incident. Therefore, failing to record the state of the computer system would be a significant oversight, as it could result in the loss of critical evidence or context regarding the crime.