When starting an investigation, which of the following must be done first?

The first and most critical step when beginning any forensic or incident investigation is to secure the scene. This foundational action involves isolating the affected physical or logical area to prevent evidence from being altered, contaminated, or destroyed. Securing the scene ensures the integrity of the evidence, which is paramount for a sound investigation. All subsequent actions, such as collecting evidence, interviewing personnel, or involving external parties, depend on the initial state of the scene being preserved. Failure to secure the scene first can render any collected evidence inadmissible or unreliable.

A. Notify law enforcement: This is a procedural step determined by organizational policy and the nature of the incident, not the immediate technical priority.

C. Seize all related evidence: Evidence collection (seizure) is performed only after the scene is secured to ensure the evidence is not modified during the process.

D. Interview the witnesses: Preserving volatile digital evidence by securing the scene is more time-critical than interviewing witnesses, whose statements can be gathered later.

---

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.1

"The Forensic Process

" page 13. The document states

"The first responder should secure the scene to prevent evidence from being altered."

2. Internet Engineering Task Force (IETF). (2002). RFC 3227

Guidelines for Evidence Collection and Archiving. Section 3

"Principles." This document emphasizes that the collection process must minimize the possibility of evidence modification

a principle that is fulfilled by first securing the scene.

3. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.3

"Containment

Eradication

& Recovery." The guide outlines containment as a primary step after detection

which involves isolating systems to prevent further damage and preserve evidence—effectively securing the digital scene.

4. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. Chapter 5

"Processing Crime and Incident Scenes

" pages 155-157. This peer-reviewed academic textbook

widely used in university curricula

details that the first step upon arriving at a scene is to secure and protect it to maintain evidence integrity.