Which of the following statements is incorrect when preserving digital evidence?
A . Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals
B . Verily if the monitor is in on, off, or in sleep mode
C . Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode
D . Turn on the computer and extract Windows event viewer log files
Answer: D