Certified Incident Handler (CIH) Practice Ecam

Which point should a first responder consider while handling evidence from handheld devices?

1. Turn off the device immediately

2. Photograph the screen display of the device

3. Reset the device to prevent data loss

4. Disconnect power sources

The correct answer is: Photograph the screen display of the device

Photographing the screen display of the device is a crucial step for a first responder handling evidence from handheld devices. This action allows for the preservation of the current state of the device, which can be critical for later analysis. Capturing images of the screen can provide vital information regarding the contents, applications, and any ongoing communications at the time of the incident. In incidents involving digital evidence, maintaining a clear record of what was visible on the device helps in documenting the context and understanding the usage of the device at the time it was seized. This visual evidence can support investigations and legal proceedings as it represents a snapshot that may reflect important information relevant to the case. Considering the other options, turning off the device may result in the loss of volatile data, resetting it can lead to irretrievable data loss, and disconnecting power sources could potentially alter key information necessary for investigation. These actions prioritize immediate device state changes that could compromise evidence integrity, underscoring the importance of visual documentation as a critical first step in the evidence preservation process.