MENU
A forensic examiner should always turn off a mobile device at the time of seizure and before starting an acquisition.
Suggested Answer: B
Get Premium CCII Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Forensic best practices recommendkeeping the device powered onbecause:
Turning off the device may trigger encryption locks, making data inaccessible.
Live data acquisitionallows retrieval of RAM contents, running apps, and network logs.
Airplane mode should be enabled instead of shutting downto prevent remote wiping.
29 comments · newest first
EL
Elenor
7 months ago
B) False could be risky. We need to capture everything possible.
RO
Ronald
7 months ago
I lean towards A) True. Better safe than sorry!
EL
Elly
7 months ago
But what if the device is locked? B) False could help access it.
BR
Brice
7 months ago
A) True makes sense. We need to preserve evidence.
LI
Linsey
7 months ago
I disagree, B) False. You might lose volatile data if you turn it off.
TA
Tabetha
7 months ago
Seems risky, what if you lose something important by shutting it down?
GL
Glenn
8 months ago
Always turn it off, it's standard procedure.
SC
Scarlet
8 months ago
Wait, really? I thought you could just take a snapshot.
VA
Van
8 months ago
I disagree, sometimes you need to keep it on for evidence.
EL
Elenor
9 months ago
False, how else am I supposed to play Angry Birds during the exam?
AL
Alesia
9 months ago
True, can't have that device self-destructing on me.
DA
Dahlia
9 months ago
False, I need that GPS data for my investigation!
FL
Fletcher
9 months ago
True, gotta preserve that battery life!
IN
In
9 months ago
This is tricky! I remember some guidelines saying to keep the device on to avoid altering evidence, but I can’t remember if that applies to all situations.
IR
Irene
9 months ago
I recall a case study where turning off the device caused data loss, so I think it should be False.
AL
Alesia
10 months ago
I’m not entirely sure, but I feel like there were practice questions that mentioned the risks of turning off a device. Maybe it’s True?
CR
Craig
10 months ago
I think we discussed this in class, and I remember something about preserving the state of the device. So, I’m leaning towards False.
MI
Mitsue
10 months ago
Wait, is this a trick question? I thought we were supposed to leave the device powered on to capture any live data. Now I'm second-guessing myself. I'll have to review my notes on this.
HE
Helene
10 months ago
Okay, I remember learning about this in class. Turning off the device is important to prevent any changes to the data before the forensic examination. I'll mark this as true.
CO
Colton
10 months ago
I think it's A) True. Turning it off prevents data alteration.
NO
Noah
11 months ago
Definitely true, you don't want to alter any data.
HE
Herman
11 months ago
Turning off the device is the way to go. That ensures the data is preserved in its original state. I'm feeling good about selecting true for this one.
LA
Lauryn
11 months ago
Hmm, I'm a bit unsure about this one. I know we need to handle devices carefully, but I can't recall if turning it off is always required. I'll have to think this through.
MI
Miles
12 months ago
I'm pretty confident this is true. Turning off the device before acquisition is a standard forensic procedure to preserve the data.
AL
Alberta
6 months ago
Can't risk losing data during acquisition.
PA
Patrick
6 months ago
Yeah, preserving evidence is key.
BA
Barbra
6 months ago
True! It's a basic step in forensics.
CH
Christiane
10 months ago
I agree, turning it off is crucial.
HE
Hershel
11 months ago
Definitely, it prevents data alteration.