EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 6 : Windows Forensics
         
Questions available : 94 You are not logged in.
Please Login for track your learning progress
   
 
Q. No: 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 |
Go to Question No.



Question No 71

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.
 
   
Bookmark this Question
QID: 674  
   
When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:


 
A:    Recycle Bin
  
B:    MSDOS.sys
C:    BIOS
  
D:    Case files
 
         

 
 

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer



Comunity Comments:

Banwari on 16/05/2025
Opted Answer: A
System Processes: Windows automatically updates system files, logs, and registry entries upon startup.

Recycle Bin Activity: If deleted files exist, Windows may modify metadata or create new entries.

File Indexing: Windows may index files for faster search functionality, altering timestamps.

Temporary Files: The OS generates temporary files that could overwrite forensic evidence.
0 
0 

















WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Certification Examinations