Eccouncil Exam 312-49 Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 47
Topic #: 1

[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

AWhen the computer boots up, files are written to the computer rendering the data nclean

BWhen the computer boots up, the system cache is cleared which could destroy evidence

CWhen the computer boots up, data in the memory buffer is cleared which could destroy evidence

DPowering on a computer has no affect when needing to acquire digital evidence from it

Show Suggested Answer

Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Bette

4 days ago

Hmm, I'm going with Option C. Clearing the memory buffer could definitely destroy important evidence. Better safe than sorry, right?

upvoted 0 times

...

Yoko

7 days ago

Option D is just plain ridiculous. Of course powering on the computer has an effect on the digital evidence! What are they thinking?

upvoted 0 times

...

Kina

14 days ago

I'd have to agree with Suzi. Booting up the computer is a big no-no when trying to preserve digital evidence. It's like putting a giant 'ERASE ME' sign on the data.

upvoted 0 times

...

Suzi

15 days ago

Option A seems to be the correct answer. Powering on the computer could potentially write new data to the hard drive, which could overwrite or corrupt the existing evidence.

upvoted 0 times

...