Which steps are part of investigating a computer crime?

• A. Determine if it happened, identify clues, collect evidence, and seize computer equipment
• B. Only interview suspects
• C. Immediately shut down all systems without evidence
• D. Focus solely on legal filings

Answer: (C)

Investigating a computer crime requires a disciplined, evidence‑driven approach that preserves what happened while collecting usable data. The process typically starts with confirming whether an incident occurred and defining its scope, then gathering clues and preserving evidence in a way that keeps its integrity intact. This includes seizing relevant equipment and creating exact copies of data (forensic images) so analysis can proceed without altering the originals, and maintaining a clear chain of custody for every item handled. Handling volatile data first—before powering down if possible—and documenting every action are crucial to reconstructing events accurately. While interviewing people can add context, it cannot replace the technical steps of evidence collection and equipment seizure, nor is it sufficient on its own to build a case. Shutting down systems immediately without a plan can destroy or overwrite evidence and hinder the investigation, so actions should be chosen to preserve data while stopping further tampering. Focusing only on legal filings neglects the practical steps needed to uncover what happened and support any resulting actions.