New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 312-49 Exam - Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam
Question #: 47
Topic #: 1
[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Huey
3 months ago
I’m not sure, how much data really gets lost when you boot?
upvoted 0 times
...
Meaghan
3 months ago
Clearing the memory buffer is a big deal, don't turn it on!
upvoted 0 times
...
Merilyn
4 months ago
Wait, powering on has no effect? That sounds off.
upvoted 0 times
...
Jutta
4 months ago
Totally agree, evidence can get messed up.
upvoted 0 times
...
Crista
4 months ago
Booting up can change files, so it's risky!
upvoted 0 times
...
Leontine
4 months ago
I feel like option D is definitely wrong. Powering on a computer must have some effect on the evidence, but I can't pinpoint why.
upvoted 0 times
...
France
4 months ago
I practiced a question like this before, and I think the system cache being cleared was mentioned as a concern. But I can't recall the exact details.
upvoted 0 times
...
Yolando
5 months ago
I think it has to do with the memory buffer being cleared when you boot it up. That could definitely destroy evidence, right?
upvoted 0 times
...
Werner
5 months ago
I remember reading that powering on a computer can change the state of the data, but I'm not sure if it's just about files being written or something else.
upvoted 0 times
...
Elenor
5 months ago
I've got this! The solution is to attach the mlvm VM as a compute target, install the Azure ML SDK on my local machine, and then run the training script as an experiment on the remote resource. Easy peasy.
upvoted 0 times
...
Shonda
5 months ago
This question seems straightforward, I think I can handle it.
upvoted 0 times
...
Kaycee
9 months ago
Imagine someone trying to acquire digital evidence by just turning the computer on and off like a light switch. That's a sure-fire way to 'accidentally' delete everything!
upvoted 0 times
Leandro
8 months ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Elouise
8 months ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Reid
8 months ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Bette
10 months ago
Hmm, I'm going with Option C. Clearing the memory buffer could definitely destroy important evidence. Better safe than sorry, right?
upvoted 0 times
Launa
8 months ago
User 3: I'm not so sure. I think Option B is the best answer. Clearing the system cache could really mess up the evidence.
upvoted 0 times
...
Maynard
8 months ago
User 2: I agree with Maynard. Option A seems like the safest choice to preserve the digital evidence.
upvoted 0 times
...
Amber
8 months ago
User 1: I think Option A is the correct answer. Files being written to the computer could definitely make the data unclean.
upvoted 0 times
...
...
Yoko
10 months ago
Option D is just plain ridiculous. Of course powering on the computer has an effect on the digital evidence! What are they thinking?
upvoted 0 times
Yuette
8 months ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Thora
9 months ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Nickolas
9 months ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Kina
10 months ago
I'd have to agree with Suzi. Booting up the computer is a big no-no when trying to preserve digital evidence. It's like putting a giant 'ERASE ME' sign on the data.
upvoted 0 times
Gianna
9 months ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Rochell
9 months ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Staci
9 months ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Suzi
10 months ago
Option A seems to be the correct answer. Powering on the computer could potentially write new data to the hard drive, which could overwrite or corrupt the existing evidence.
upvoted 0 times
...
Clemencia
11 months ago
I also agree. The system cache being cleared when the computer boots up could definitely destroy evidence.
upvoted 0 times
...
Mendy
11 months ago
I agree with Lynda. When the computer boots up, files are written to the computer, making the data unclean.
upvoted 0 times
...
Lynda
11 months ago
I think we should never power on a computer we need to acquire digital evidence from because it could destroy evidence.
upvoted 0 times
...

Save Cancel