What Is the First Step When Searching a Cybercrime Scene for Evidence?
A Computer Hacking Forensic Investigator (CHFI) arrives at the crime scene in an incident involving cybercrime. While performing the initial search of the scene, the investigator spots a GPS device, a keyboard, and a telephone line connected to a caller ID box. Considering the steps involved in searching for evidence, which of the following actions should the investigator perform first?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the CHFI ordering of evidence-search steps — record the scene as found before disturbing, surveying, or collecting anything — while the trap is to jump straight to a visible, urgent-looking task like securing the keyboard for fingerprints.
When a CHFI spots a GPS device, keyboard, and caller ID box during the initial scene search, the correct first action is to record observations about the scene as it currently stands. This page explains why documenting the situation (C) must precede protecting fingerprints, surveying individual devices, and opening the evidence log.
Most candidates choose A, securing the keyboard to preserve fingerprints, because physical evidence feels the most time-sensitive; however, that is a later step and can only be justified after the scene's current condition and item positions have been recorded.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CHFI doctrine places documentation at the front of the evidence-search sequence because a written record survives, while fingerprints, keystrokes, and caller-ID data are destroyed the moment the scene is handled. EC-Council's first-response model begins with documenting the electronic crime scene before collecting incident information, planning search and seizure, and identifying and collecting electronic evidence. Within the search steps, the investigator first records observations about the current situation — where the GPS device, keyboard, and the telephone line running to the caller ID box are situated and in what condition. Only then can the survey for sources of digital evidence and the physical protection of items be performed coherently, which is why C is the only action that can legitimately come first.Why the Other Options Are Wrong
A is a genuine later step: protecting latent fingerprints on keyboards, mice, and similar peripherals follows the survey and documentation phases, and bagging the keyboard first would erase its positional context. B is a collection-phase artifact — the search and seizure evidence log is created after planning, to record items as they are identified and taken, not before the scene has been documented. D narrows the survey to a single item and pushes exploration ahead of documentation; the survey step covers the whole scene, and the investigator has already located the GPS device during the initial walk-through, so re-surveying it for information adds nothing at this stage.Community Comment Notes
seyfoo91 insists that "according to ECCOUNCIL's the answer should be A", which mirrors the source key rather than the underlying procedure. aqeel1506 argues the opposite — that the investigator "documents the scene as it was found before any evidence is disturbed" — which is exactly the documentation-first rule. 044f354 anchors the discussion in the official CHFI Module 02 pages 117–118, where "Documenting the Electronic Crime Scene" is listed as the first stage of laboratory first response. Elb quotes the search sequence and notes that the team should "Protect physical evidence or hidden fingerprints that may be found on keyboards" only after the initial survey, and then trace the telephone line to the caller ID box — confirming that A describes a subsequent step, not the first one.Official Reference
Exam Strategy
When a CHFI question asks for the 'first' action at a scene, eliminate every option that handles, bags, or logs a specific item — those belong to the collection phase. Look instead for the option that captures the scene's present state, because documentation is always ordered before survey, seizure, and packaging.
Frequently Asked Questions
Why is securing the keyboard for fingerprints not the first step?
Fingerprint protection comes after the scene is documented and surveyed; handling the keyboard first destroys the positional context and the record of how the scene was found.
When should the search and seizure evidence log be started?
Only after the scene is documented and the search is planned; the log then records each item identified and collected, so starting it first skips a CHFI stage.