EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 2 : Computer Forensics Investigation Process
         
Questions available : 60 You are not logged in.
Please Login for track your learning progress
   
 
Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
Go to Question No.



Question No 0

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.
 
   
Bookmark this Question
QID: 652  
   
Why should you never power on a computer that you need to acquire digital evidence from?


 
A:    When the computer boots up, files are written to the computer rendering the data unclean
  
B:    When the computer boots up, the system cache is cleared which could destroy evidence
C:    When the computer boots up, data in the memory buffer is cleared which could destroy evidence
  
D:    Powering on a computer has no affect when needing to acquire digital evidence from it
 
         

 
 

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer



Comunity Comments:

Krishna on 12/03/2024
Opted Answer: B
When a computer is powered on, it starts executing various processes, which could potentially overwrite or clear volatile data stored in memory buffers. This could lead to the destruction or alteration of digital evidence that might be present in the memory.
0 
0 

Pradeep Thomas on 08/05/2024
I think the best answer here is A. Its has been repeated many times in all digital forensics material that booting a computer up may change the checksum of the entire disk, especially windows. Different checksum means the data is unclean.
1 
0 

















WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Certification Examinations