Who is described as responsible for documenting any activity on the computer or components to prevent alteration of digital evidence, and who should take photographs?

• A. First Responders
• B. Lead Investigator
• C. System Administrator
• D. Security Analyst

Answer: (A)

The main idea is to preserve digital evidence from the moment investigators arrive. First responders are the ones who secure the scene and create an objective record before any changes are made. They document what is happening on the computer and its components, noting system status, connected devices, user activity, and any signs of tampering. This documentation helps prevent alterations because it shows the state of the evidence as discovered, establishing a baseline for later analysis and supporting the chain of custody. They also take photographs of the hardware, cables, screens, and the overall setup to capture the physical context and condition of the equipment at the time of discovery. This combination of notes and photos provides a clear, defensible record that guides subsequent forensic work.