When a computer is powered on, data in the memory buffer is cleared which could potentially destroy evidence. The memory buffer, also known as RAM (Random Access Memory), is where a computer temporarily stores data and programs that are currently running. If the computer is shut down improperly, or if the power is cut off, the data in the memory buffer may be lost or corrupted. This is why it is important to avoid powering on a computer that you need to acquire digital evidence from. Instead, you should use specialized software and hardware tools to extract the data from the computer's hard drive in a forensically sound manner, without altering or destroying any of the data.
Umm, this is wrong? You said it yourself, memory buffer is located in RAM, but any data in RAM would be lost after the computer shuts down.
The best answer here is A. Its has been repeated many many times in all digital forensics material in Sec+, CISSP, etc., that booting a computer up may change the checksum of the entire disk, especially windows. Different checksum means the data is unclean.
This is a forensics course.
Your mindset should always be forensics first.
Preserving the system in its current state is crucial for forensic integrity.
A. Correct: Booting a computer modifies the system (e.g., updating logs, temp files), potentially overwriting critical evidence.
B. Incorrect: The system cache is not cleared during boot; this option misrepresents the behavior of caches.
C. Incorrect: Data in memory buffers is already volatile and lost when the computer is powered off, not during boot-up.
D. Incorrect: Powering on a computer does affect digital evidence integrity by altering data on the disk.
A is correct due to that the computer ram when it was down is already free
upvoted 4 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Manzer
Highly Voted 9 months, 2 weeks ago[Removed]
2 months, 1 week ago044f354
Most Recent 1 week, 4 days agolol105
1 month ago