Which of the following statements is incorrect when preserving digital evidence?
A.
Document the actions and changes that you observe in the monitor, computer, printer, or in
other peripherals
B.
Verily if the monitor is in on, off, or in sleep mode
C.
Remove the power cable depending on the power state of the computer i.e., in on. off, or in
sleep mode
D.
Turn on the computer and extract Windows event viewer log files