A Computer Hacking Forensic Investigator (CHFI) arrives at the crime scene in an incident involving cybercrime. While performing the initial search of the scene, the investigator spots a GPS device, a keyboard, and a telephone line connected to a caller ID box. Considering the steps involved in searching for evidence, which of the following actions should the investigator perform first?
The first action the investigator should perform when arriving at a crime scene is to record observations about the current situation. This is essential to document the initial state of the scene, as it helps preserve the context and condition of the evidence before any further actions are taken. Recording observations ensures that any changes made during the evidence collection process can be accurately traced, which is crucial for maintaining the integrity of the investigation.
according to ECCOUNCIL's the answer should be A A : secure the keyboard
Once the forensics team has arrived at the scene and unloaded their equipment, the first task is to try to identify any evidence. 1-) Survey the crime scene to recognize potential sources of evidence. 2-) Protect physical evidence or hidden fingerprints that may be found on keyboards, mice and other equipment. 3-) Find telephone lines that are connected to devices such as modems, and caller ID boxes, [ 4-) Observe the current situation at the scene, and record observations 5-) Maintain a search and seizure evidence log to document the details of all the electronic devices and media identified during the search for evidence 6-) Search the scene for secondary storage media such as diskettes, wireless hard disks, USB drives, tapes, etc.