Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 312-49 Exam - Topic 1 Question 47 Discussion

Why should you never power on a computer that you need to acquire digital evidence from?
B) When the computer boots up, the system cache is cleared which could destroy evidence
A) When the computer boots up, files are written to the computer rendering the data nclean
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
D) Powering on a computer has no affect when needing to acquire digital evidence from it

Eccouncil 312-49 Exam - Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam
Question #: 47
Topic #: 1
[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Huey
9 months ago
I’m not sure, how much data really gets lost when you boot?
upvoted 0 times
...
Meaghan
10 months ago
Clearing the memory buffer is a big deal, don't turn it on!
upvoted 0 times
...
Merilyn
10 months ago
Wait, powering on has no effect? That sounds off.
upvoted 0 times
...
Jutta
10 months ago
Totally agree, evidence can get messed up.
upvoted 0 times
...
Crista
10 months ago
Booting up can change files, so it's risky!
upvoted 0 times
...
Leontine
11 months ago
I feel like option D is definitely wrong. Powering on a computer must have some effect on the evidence, but I can't pinpoint why.
upvoted 0 times
...
France
11 months ago
I practiced a question like this before, and I think the system cache being cleared was mentioned as a concern. But I can't recall the exact details.
upvoted 0 times
...
Yolando
11 months ago
I think it has to do with the memory buffer being cleared when you boot it up. That could definitely destroy evidence, right?
upvoted 0 times
...
Werner
11 months ago
I remember reading that powering on a computer can change the state of the data, but I'm not sure if it's just about files being written or something else.
upvoted 0 times
...
Elenor
11 months ago
I've got this! The solution is to attach the mlvm VM as a compute target, install the Azure ML SDK on my local machine, and then run the training script as an experiment on the remote resource. Easy peasy.
upvoted 0 times
...
Shonda
11 months ago
This question seems straightforward, I think I can handle it.
upvoted 0 times
...
Kaycee
1 year ago
Imagine someone trying to acquire digital evidence by just turning the computer on and off like a light switch. That's a sure-fire way to 'accidentally' delete everything!
upvoted 0 times
Leandro
1 year ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Elouise
1 year ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Reid
1 year ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Bette
1 year ago
Hmm, I'm going with Option C. Clearing the memory buffer could definitely destroy important evidence. Better safe than sorry, right?
upvoted 0 times
Launa
1 year ago
User 3: I'm not so sure. I think Option B is the best answer. Clearing the system cache could really mess up the evidence.
upvoted 0 times
...
Maynard
1 year ago
User 2: I agree with Maynard. Option A seems like the safest choice to preserve the digital evidence.
upvoted 0 times
...
Amber
1 year ago
User 1: I think Option A is the correct answer. Files being written to the computer could definitely make the data unclean.
upvoted 0 times
...
...
Yoko
1 year ago
Option D is just plain ridiculous. Of course powering on the computer has an effect on the digital evidence! What are they thinking?
upvoted 0 times
Yuette
1 year ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Thora
1 year ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Nickolas
1 year ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Kina
1 year ago
I'd have to agree with Suzi. Booting up the computer is a big no-no when trying to preserve digital evidence. It's like putting a giant 'ERASE ME' sign on the data.
upvoted 0 times
Gianna
1 year ago
C) When the computer boots up, data in the memory buffer is cleared which could destroy evidence
upvoted 0 times
...
Rochell
1 year ago
B) When the computer boots up, the system cache is cleared which could destroy evidence
upvoted 0 times
...
Staci
1 year ago
A) When the computer boots up, files are written to the computer rendering the data unclean
upvoted 0 times
...
...
Suzi
1 year ago
Option A seems to be the correct answer. Powering on the computer could potentially write new data to the hard drive, which could overwrite or corrupt the existing evidence.
upvoted 0 times
...
Clemencia
1 year ago
I also agree. The system cache being cleared when the computer boots up could definitely destroy evidence.
upvoted 0 times
...
Mendy
1 year ago
I agree with Lynda. When the computer boots up, files are written to the computer, making the data unclean.
upvoted 0 times
...
Lynda
1 year ago
I think we should never power on a computer we need to acquire digital evidence from because it could destroy evidence.
upvoted 0 times
...

Save Cancel