Which of the following statements is incorrect when preserving digital evidence?

A.
Turn on the computer and extract Windows event viewer log files

B.
Remove the power cable depending on the power state of the computer i.e., in on. off, or in
sleep mode

C.
Verily if the monitor is in on, off, or in sleep mode

D.
Document the actions and changes that you observe in the monitor, computer, printer, or in
other peripherals

Explanation: