Rachel, a first responder, finds a smartphone in an executive’s office that is powered ON...

Rachel is applying the forensic principle of preserving volatile and screen-based digital evidence, which is a core concept in the ECIH First Response and Digital Forensics modules. When a mobile device is powered on and unlocked, the data visible on the screen—such as messages, timestamps, sender details, and session states—constitutes volatile evidence that may be lost permanently if the device locks, reboots, or powers off.

ECIH guidance instructs first responders to document the live state of a device before any interaction that could alter its condition. Photographing the screen captures evidence that may not be recoverable later due to encryption or session expiration. Maintaining power ensures the device does not enter a locked or encrypted state during transport.

Option A refers to forensic analysis, not first response. Option C would destroy evidence and violates forensic principles. Option D risks loss of volatile data.

Preserving screen-based evidence ensures integrity, admissibility, and continuity of evidence, making Option B correct.