When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented
a. Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
b. Start the suspect's computer and begin collecting evidence.
c. The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
d. Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.
Answer: C