Options:
a. remove the hard drive
b. transport it while running
c. perform a clean shutdown
d. unplug it
Answer:
d. unplug it
Step-by-step explanation:
Indeed, unplugging the computer often the best strategy for dealing with a computer that is powered on so to preserve (or collect) digital evidence. By so doing it allows the investigator to safely check through the computer found at the crime scene.
However, if the investigator decides to remove the hard drive or performing a clean shutdown, valuable evidence may be lost as a result. Also, transporting it while running isn't going to be a viable option.