Eccouncil Exam 312-49 Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 47
Topic #: 1

[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

AWhen the computer boots up, files are written to the computer rendering the data nclean

BWhen the computer boots up, the system cache is cleared which could destroy evidence

CWhen the computer boots up, data in the memory buffer is cleared which could destroy evidence

DPowering on a computer has no affect when needing to acquire digital evidence from it

Show Suggested Answer

Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kaycee

2 months ago

Imagine someone trying to acquire digital evidence by just turning the computer on and off like a light switch. That's a sure-fire way to 'accidentally' delete everything!

upvoted 0 times

Leandro

26 days ago

C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence

upvoted 0 times

...

Elouise

1 months ago

B) When the computer boots up, the system cache is cleared which could destroy evidence

upvoted 0 times

...

Reid

1 months ago

A) When the computer boots up, files are written to the computer rendering the data unclean

upvoted 0 times

...

Bette

2 months ago

Hmm, I'm going with Option C. Clearing the memory buffer could definitely destroy important evidence. Better safe than sorry, right?

upvoted 0 times

Launa

26 days ago

User 3: I'm not so sure. I think Option B is the best answer. Clearing the system cache could really mess up the evidence.

upvoted 0 times

...

Maynard

28 days ago

User 2: I agree with Maynard. Option A seems like the safest choice to preserve the digital evidence.

upvoted 0 times

...

Amber

1 months ago

User 1: I think Option A is the correct answer. Files being written to the computer could definitely make the data unclean.

upvoted 0 times

...

Yoko

2 months ago

Option D is just plain ridiculous. Of course powering on the computer has an effect on the digital evidence! What are they thinking?

upvoted 0 times

Yuette

1 months ago

C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence

upvoted 0 times

...

Thora

2 months ago

B) When the computer boots up, the system cache is cleared which could destroy evidence

upvoted 0 times

...

Nickolas

2 months ago

A) When the computer boots up, files are written to the computer rendering the data unclean

upvoted 0 times

...

Kina

3 months ago

I'd have to agree with Suzi. Booting up the computer is a big no-no when trying to preserve digital evidence. It's like putting a giant 'ERASE ME' sign on the data.

upvoted 0 times

Gianna

2 months ago

C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence

upvoted 0 times

...

Rochell

2 months ago

B) When the computer boots up, the system cache is cleared which could destroy evidence

upvoted 0 times

...

Staci

2 months ago

A) When the computer boots up, files are written to the computer rendering the data unclean

upvoted 0 times

...

Suzi

3 months ago

Option A seems to be the correct answer. Powering on the computer could potentially write new data to the hard drive, which could overwrite or corrupt the existing evidence.

upvoted 0 times

...