Eccouncil Exam 312-49 Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 47
Topic #: 1

[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

AWhen the computer boots up, files are written to the computer rendering the data nclean

BWhen the computer boots up, the system cache is cleared which could destroy evidence

CWhen the computer boots up, data in the memory buffer is cleared which could destroy evidence

DPowering on a computer has no affect when needing to acquire digital evidence from it

Show Suggested Answer

Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

19 days ago

I also agree. The system cache being cleared when the computer boots up could definitely destroy evidence.

upvoted 0 times

...

20 days ago

I agree with Lynda. When the computer boots up, files are written to the computer, making the data unclean.

upvoted 0 times

...

25 days ago

I think we should never power on a computer we need to acquire digital evidence from because it could destroy evidence.

upvoted 0 times

...