- Reconnect the SATA data cables to ensure continued data backup.
- Disconnect the SATA power cables to prevent the loss of persistent data.
- Place the hard drives in an external enclosure and begin backing up the data before releasing the drives to first responders.
- Locate an employee qualified to collect evidence.
- Dust the server computer case for fingerprints.
Explanation: When a potential crime scene is found, a chain of custody must be observed and followed. The technician should immediately locate another employee who is qualified to collect evidence. Disconnecting or reconnecting the drives or attempting to move data may adversely affect the chain of custody.
More Questions: Final Exam – Composite (Chapters 1-14)