Eccouncil Exam 312-49 Topic 1 Question 47 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 47
Topic #: 1

[All 312-49 Questions]

Why should you never power on a computer that you need to acquire digital evidence from?

AWhen the computer boots up, files are written to the computer rendering the data nclean

BWhen the computer boots up, the system cache is cleared which could destroy evidence

CWhen the computer boots up, data in the memory buffer is cleared which could destroy evidence

DPowering on a computer has no affect when needing to acquire digital evidence from it

Show Suggested Answer

Suggested Answer: B

by Fletcher at Aug 09, 2023, 08:49 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kaycee

26 days ago

Imagine someone trying to acquire digital evidence by just turning the computer on and off like a light switch. That's a sure-fire way to 'accidentally' delete everything!

upvoted 0 times

...

Bette

1 months ago

Hmm, I'm going with Option C. Clearing the memory buffer could definitely destroy important evidence. Better safe than sorry, right?

upvoted 0 times

...

Yoko

1 months ago

Option D is just plain ridiculous. Of course powering on the computer has an effect on the digital evidence! What are they thinking?

upvoted 0 times

Thora

9 days ago

B) When the computer boots up, the system cache is cleared which could destroy evidence

upvoted 0 times

...

Nickolas

12 days ago

A) When the computer boots up, files are written to the computer rendering the data unclean

upvoted 0 times

...

2 months ago

I think we should never power on a computer we need to acquire digital evidence from because it could destroy evidence.

upvoted 0 times

...