Which is a standard procedure to perform during all computer forensics investigations?

A fundamental procedure in computer forensics is to preserve the integrity of the original evidence. Booting a suspect computer from its internal hard drive will alter data, including file access times, log files, and temporary files, thereby contaminating the evidence. The standard practice is to first remove the evidence drive. Subsequently, the investigator can safely power on the system to enter the BIOS/UEFI and document the system's date and time stored in the CMOS. This recorded time is critical for establishing a correct timeline of events, as it provides the baseline against which all file timestamps on the evidence drive will be compared.

B: The File Allocation Table (FAT) is a filesystem component that tracks file locations; it does not store the system's real-time clock.

C: RAM (Random Access Memory) is volatile. It loses its contents when the system is powered off and does not persistently store the system time.

D: This procedure is incorrect because booting the PC with the original hard drive installed will alter the evidence, violating a core principle of digital forensics.

1. National Institute of Justice (NIJ), U.S. Department of Justice. (2008). Electronic Crime Scene Investigation: A Guide for First Responders (Second Edition). Document NCJ 219941. In Section 3, "Procedure for Seizure of Electronic Evidence: Stand-Alone Personal Computers (PCs)," the guide emphasizes that if a computer is off, it should not be turned on by the first responder. The subsequent laboratory examination process involves documenting the system's internal settings (BIOS/CMOS) without booting from the evidence media.

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. In Chapter 7, "Processing the Crime Scene," the text outlines the procedure for handling a computer that is powered off. It states, "Documenting the system date and time is important because it is used to set the time and date stamps on files... check the system time in the BIOS after transporting it to a secure location" (p. 189). This implies the system is examined without booting from the original drive.

3. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 2, "Computer Foundations," explains that the BIOS settings, including the system time, are stored in non-volatile CMOS memory. Chapter 3, "Volume Analysis," reinforces the core principle of acquiring a bit-for-bit copy of the media without altering the original, which precludes booting from the suspect drive.