4. The first action with respect to a computer device is

a. Clone the storage device (for example, the hard drive).

b. Power it down.

c. Perform an online lookup of its security features.

d. None of the above.

5. Encrypted data on a hard drive

a. Can always be decrypted by using a commercial-grade forensic tool kit.

b. May be permanently out of reach for the practitioner.

c. May be unlocked by contacting the vendor of the encrypting software.

d. None of the above.

6. Once the power is off, the computer disk or storage device should be

a. Removed from the computer and then cloned.

b. Kept in the computer and cloned.

c. Cloned and then removed from the computer.

d. None of the above.