Question

if an investigator finds a computer that is turned off during a search with a warrant, the investigator should
select one:
a. turn on the computer
b. unplug the computer from the wall
c. leave the computer turned off
d. none of the above

which of the following should be recorded by investigators when storing computer evidence?
select one:
a. serial number
b. make
c. model
d. all of the above

Explanation:

For the first question, when an investigator finds a turned - off computer during a search with a warrant, turning it on could potentially alter data (e.g., if there are auto - save or encryption processes that start on boot). Unplugging it (B) is a better option than leaving it (C) as leaving it may not preserve the state as effectively as proper disconnection. Option A is incorrect as it risks data changes.
For the second question, when storing computer evidence, the serial number (A) helps in uniquely identifying the device, the make (B) and model (C) are important for understanding its capabilities and potential evidence - related features. So all of these (D) should be recorded.

Answer:

First question: B. Unplug the computer from the wall
Second question: D. All of the above