An employee has been accused of carrying out a crime from his corporate desktop PC. You have been asked to capture the current state of the PC, including all of its contents, according to proper forensic rules. When you locate the PC, it is turned off. What is the order of capture for this system?

A. hard drive, BIOS settings, external media
B. RAM, hard drive, external media
C. RAM, external media, hard drive
D. hard drive, external media, BIOS settings


A
Explanation: You should capture the forensic data in the following order: hard drive, BIOS settings, and external media.
RAM content would only be important if the PC was still running when you located it.

Computer Science & Information Technology

You might also like to view...

Which of the following is not a KeyListener method?

a. keyPressed. b. keyReleased. c. keyClicked. d. keyTyped.

Computer Science & Information Technology

What is wrong with this while loop?

``` int count = 0; while(count < 50) { cout<

Computer Science & Information Technology

The amount of time that Photoshop takes to move from one frame to another during playback is called the delay time.

Answer the following statement true (T) or false (F)

Computer Science & Information Technology

_____ occurs when the personal information of an individual is stolen and used.

a. Trustworthy computing b. Cyberespionage c. Cyberterrorism d. Identity theft

Computer Science & Information Technology