A bench technician enters the server room and finds the backup server computer case open. The hard drives containing patient medical data are all physically disconnected from the motherboard and the SATA data cables are hanging outside the case. Which step should the technician immediately take?

A bench technician enters the server room and finds the backup server computer case open. The hard drives containing patient medical data are all physically disconnected from the motherboard and the SATA data cables are hanging outside the case. Which step should the technician immediately take?

• Reconnect the SATA data cables to ensure continued data backup.
• Disconnect the SATA power cables to prevent the loss of persistent data.
• Place the hard drives in an external enclosure and begin backing up the data before releasing the drives to first responders.
• Locate an employee qualified to collect evidence.
• Dust the server computer case for fingerprints.

Explanation: When a potential crime scene is found, a chain of custody must be observed and followed. The technician should immediately locate another employee who is qualified to collect evidence. Disconnecting or reconnecting the drives or attempting to move data may adversely affect the chain of custody.

Exam with this question: Final Exam - Composite (Chapters 1-14)
Exam with this question: IT Essentials ( Version 8.0) Final Exam (Chapters 10-14)