Which of the following is the MOST ACCURATE statement?

Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas’s personal computer for forensic examination .

Which of the following is the MOST ACCURATE statement?
A . If Lucas’s computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data
B. If Lucas’s computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interlace.
C. If Lucas’s computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
D. If Lucas’s computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process

Answer: C