When collecting digital evidence from a crime scene, often the best strategy for dealing with a computer that is powered on is to:

Options:

a. remove the hard drive

b. transport it while running

c. perform a clean shutdown

d. unplug it

d. unplug it

Explanation:

Indeed, unplugging the computer often the best strategy for dealing with a computer that is powered on so to preserve (or collect) digital evidence. By so doing it allows the investigator to safely check through the computer found at the crime scene.

However, if the investigator decides to remove the hard drive or performing a clean shutdown, valuable evidence may be lost as a result. Also, transporting it while running isn't going to be a viable option.