An employee has been accused of carrying out a crime from his corporate desktop PC. You have been asked to capture the current state of the PC, including all of its contents, according to proper forensic rules. When you locate the PC, it is turned off. What is the order of capture for this system?
A. hard drive, BIOS settings, external media
B. RAM, hard drive, external media
C. RAM, external media, hard drive
D. hard drive, external media, BIOS settings
A
Explanation: You should capture the forensic data in the following order: hard drive, BIOS settings, and external media.
RAM content would only be important if the PC was still running when you located it.
You might also like to view...
Which of the following is not a KeyListener method?
a. keyPressed. b. keyReleased. c. keyClicked. d. keyTyped.
What is wrong with this while loop?
```
int count = 0;
while(count < 50)
{
cout<
The amount of time that Photoshop takes to move from one frame to another during playback is called the delay time.
Answer the following statement true (T) or false (F)
_____ occurs when the personal information of an individual is stolen and used.
a. Trustworthy computing b. Cyberespionage c. Cyberterrorism d. Identity theft