Which action should be taken to preserve evidence after a security incident?

• A. Delete digital records to protect privacy
• B. Do not touch or alter items; isolate the area; preserve evidence
• C. Photograph every passenger involved
• D. Ignore the area and continue service

Answer: (B)

Preserving evidence hinges on keeping the scene as intact as possible so investigators can determine what happened. The best action is to avoid touching or altering items, isolate the area to prevent further disturbance, and preserve evidence for investigators. By not interacting with items, you prevent contamination; by isolating the area, you stop others from modifying clues; and by preserving the evidence, you maintain the integrity of physical traces and digital records needed for an accurate investigation.

Deleting digital records would erase important traces and hinder the investigation. Photographing every passenger involved could raise privacy concerns and may not be appropriate unless part of a sanctioned procedure, and it doesn’t by itself preserve the scene. Ignoring the area and continuing service would allow evidence to be lost or destroyed.