Which practice helps preserve digital evidence?

• A. Prevent Unauthorized Access to Digital Devices.
• B. Use Faraday Bags or Airplane Mode to Prevent Remote Data Manipulation.
• C. Capture Screenshots and Logs Before Powering Down a Device.
• D. Document Device Condition, Locations, and Power States Upon Seizure.

Answer: (C)

Preserving volatile digital evidence by capturing the device’s live state before shutdown is essential because information in RAM and what’s on the screen can vanish as soon as the device is powered off. Taking screenshots and collecting logs while the device is still on creates a concrete snapshot of what was visible, which apps were running, time stamps, and system events. This data is critical for reconstructing what happened and for maintaining a reliable record that can be analyzed later, helping to establish an accurate sequence of events. It also supports evidentiary integrity by providing tangible artifacts that reflect the device’s state at the moment of seizure.

While preventing unauthorized access and using Faraday bags or airplane mode help protect the device from tampering or remote data manipulation, they don’t preserve the actual data contents. Documenting device condition, locations, and power states is important for context and chain of custody, but it doesn’t capture the ephemeral data inside the device that could be lost without capturing screenshots and logs first.