Practice question
Under a WSSECD, circumstances allow creating a forensic image on-site without removing the device. Which principle applies?
- Always remove every device regardless of circumstances.
- Never make a forensic image.
- Endeavor first to make the image on-site and limit the search to the specified place; off-site examination has its stated conditions and explanation requirements.
- Destroy the device before recording it.
- Allow officers unlimited searching of unrelated systems.
Legal references
- https://elibrary.judiciary.gov.ph/assets/pdf/journals/Collation_and_Codification_of_SC_Issuance_DIGITAL.pdf — A.M. 17-11-03-SC, July 3, 2018, Rule on Cybercrime Warrants; sections 2.3–2.8, 4, 5 and 6; PDF pages 670–680.
Answer this question in flashcards to review your response and continue practicing.