During collection, which activity may be involved when acquiring a device's content?

• A. Copying data from the device
• B. Analyzing the data on the device
• C. Imaging, copying, or printing the content
• D. Formatting the device

Answer: (C)

During collection, the goal is to preserve the device’s data in a way that the original content remains unchanged for later examination. Imaging the device creates a complete, byte-for-byte copy of everything on it, including often-hidden or deleted data, along with metadata, so investigators can analyze without touching the original. Copying data from the device is also a core part of collection to pull out files and artifacts for use in later stages. Printing the content may be used to produce a tangible record or a convenient review copy for investigators. Formatting the device, on the other hand, would alter or erase data, which is precisely what collection aims to avoid. So imaging, copying, or printing the content best represents what may be involved during collection.