Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of...

If Lucas ' s computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

If Lucas ' s computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer ' s normal interlace.

If Lucas ' s computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system ' s hard drive will not be accessed during startup.

If Lucas ' s computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process