A. When seizing a computer for examination the seizing party should look around the area for passwords because many people leave passwords near their computers.

B. When seizing a computer that is running, it is acceptable to review the files contained on the machine prior to seizing it.

C. When taking a computer for examination it the computer is off should remain off when It is removed.

D. Before removing a computer system from a scene for further analysis. It is important to document, the system's setup with photographs or diagrams