What Is the First Step When Searching a Cybercrime Scene for Evidence?

312-49v10 By islever Editorial Last updated Oct 17, 2026

Computer Forensics Investigation Process

Short answer

C Record observations about the current situation at the scene before securing the keyboard, GPS, or caller ID line.

Question

A Computer Hacking Forensic Investigator (CHFI) arrives at the crime scene in an incident involving cybercrime. While performing the initial search of the scene, the investigator spots a GPS device, a keyboard, and a telephone line connected to a caller ID box. Considering the steps involved in searching for evidence, which of the following actions should the investigator perform first?

Secure the keyboard to protect any potential fingerprints
Initiate the search and seizure evidence log to document details of the identified devices
Record observations about the current situation at the scene Correct Answer
Survey the GPS device to explore potential sources of digital information

Key Takeaways

The exam tests the CHFI ordering of evidence-search steps — record the scene as found before disturbing, surveying, or collecting anything — while the trap is to jump straight to a visible, urgent-looking task like securing the keyboard for fingerprints.

When a CHFI spots a GPS device, keyboard, and caller ID box during the initial scene search, the correct first action is to record observations about the scene as it currently stands. This page explains why documenting the situation (C) must precede protecting fingerprints, surveying individual devices, and opening the evidence log.

Common mistake: Most candidates choose A, securing the keyboard to preserve fingerprints, because physical evidence feels the most time-sensitive; however, that is a later step and can only be justified after the scene's current condition and item positions have been recorded.

Expert Analysis

Why the Answer Is Correct

CHFI doctrine places documentation at the front of the evidence-search sequence because a written record survives, while fingerprints, keystrokes, and caller-ID data are destroyed the moment the scene is handled. EC-Council's first-response model begins with documenting the electronic crime scene before collecting incident information, planning search and seizure, and identifying and collecting electronic evidence. Within the search steps, the investigator first records observations about the current situation — where the GPS device, keyboard, and the telephone line running to the caller ID box are situated and in what condition. Only then can the survey for sources of digital evidence and the physical protection of items be performed coherently, which is why C is the only action that can legitimately come first.

Why the Other Options Are Wrong

A is a genuine later step: protecting latent fingerprints on keyboards, mice, and similar peripherals follows the survey and documentation phases, and bagging the keyboard first would erase its positional context. B is a collection-phase artifact — the search and seizure evidence log is created after planning, to record items as they are identified and taken, not before the scene has been documented. D narrows the survey to a single item and pushes exploration ahead of documentation; the survey step covers the whole scene, and the investigator has already located the GPS device during the initial walk-through, so re-surveying it for information adds nothing at this stage.

Community Comment Notes

seyfoo91 insists that "according to ECCOUNCIL's the answer should be A", which mirrors the source key rather than the underlying procedure. aqeel1506 argues the opposite — that the investigator "documents the scene as it was found before any evidence is disturbed" — which is exactly the documentation-first rule. 044f354 anchors the discussion in the official CHFI Module 02 pages 117–118, where "Documenting the Electronic Crime Scene" is listed as the first stage of laboratory first response. Elb quotes the search sequence and notes that the team should "Protect physical evidence or hidden fingerprints that may be found on keyboards" only after the initial survey, and then trace the telephone line to the caller ID box — confirming that A describes a subsequent step, not the first one.

Official Reference

https://bookshelf.vitalsource.com/reader/books/9781635676969/

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a CHFI question asks for the 'first' action at a scene, eliminate every option that handles, bags, or logs a specific item — those belong to the collection phase. Look instead for the option that captures the scene's present state, because documentation is always ordered before survey, seizure, and packaging.

Frequently Asked Questions

Why is securing the keyboard for fingerprints not the first step?

Fingerprint protection comes after the scene is documented and surveyed; handling the keyboard first destroys the positional context and the record of how the scene was found.

When should the search and seizure evidence log be started?

Only after the scene is documented and the search is planned; the log then records each item identified and collected, so starting it first skips a CHFI stage.

More 312-49v10 FAQ →

Community Votes

75%

25%

75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

seyfoo91 👍 3 Answered A

according to ECCOUNCIL's the answer should be A A : secure the keyboard
aqeel1506 👍 2

C. Record observations about the current situation at the scene Explanation: Recording observations about the current situation at the scene is a critical first step. This ensures that the investigator documents the scene as it was found before any evidence is disturbed. This initial documentation can include noting the positions and conditions of all found items, any immediate visible evidence, and the overall environment. This step is essential for preserving the integrity of the scene and for future reference during the investigation.
Elb 👍 1

Once the forensics team has arrived at the scene and unloaded their equipment, the first task is to try to identify any evidence. 1-) Survey the crime scene to recognize potential sources of evidence. 2-) Protect physical evidence or hidden fingerprints that may be found on keyboards, mice and other equipment. 3-) Find telephone lines that are connected to devices such as modems, and caller ID boxes, [ 4-) Observe the current situation at the scene, and record observations 5-) Maintain a search and seizure evidence log to document the details of all the electronic devices and media identified during the search for evidence 6-) Search the scene for secondary storage media such as diskettes, wireless hard disks, USB drives, tapes, etc.
044f354 👍 1 Answered C

ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 02 Page 117-118 - First Response by Laboratory Forensics Staff The first response by laboratory forensic staff involves six stages. 1. Documenting the Electronic Crime Scene 2. Collecting Incident Information 3. Planning for Search and Seizure 4. Identifying and Collecting Electronic Evidence 5. Packaging Electronic Evidence 6. Transporting Electronic Evidence - If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to 312-49v10 Study Guide