Exam 312-49 topic 1 question 47 discussion

Actually, the correct answer is not present. If you *have* to start up a victim computer, then you would modify the BIOS to boot from USB, and remove SecureBoot, then boot up from the USB. But I wouldn't even do this. I would take the removed hard drive, clone it with a write-blocker, and then virtualize the clone. Then you can boot it up in virtualization software.

B. CMOS When you start up a suspect's computer, you should modify the CMOS (Complementary Metal-Oxide Semiconductor) settings to ensure that the computer does not boot directly from the hard drive. This is done to prevent any alterations or contamination of potential evidence on the suspect's drive. Instead, forensic investigators typically boot from a trusted forensic boot disk or USB drive, ensuring that the suspect's OS and software don't run and potentially change data.

The BIOS settings are stored in the CMOS chip. We can change the boot order in BIOS setup Utility to CD or USB to avoid the contaminate or alter data on the suspect's hard drive.

CMOS contains boot order among other basic bios settings. The battery powers this piece of memory, but it still is a cmos memory chip with a bettery.

One cannot "modify" CMOS given that it is a motherboard battery; a piece of hardware. It can however be removed. Modification of boot order however will allow boot to a different device.

Given answer is correct. You DO NOT REMOVE THE CMOS. the CMOS battery will 100% alter data. Changing the boot device does not mess with integrity whatsoever. Imagine if the hard drive being investigated had macros enabled for if certain keystrokes were not pressed upon boot that all data on the hard drive gets erased. Since you booted to that hard drive still and did not implement the proper keystrokes, now data is erased and the investigation gets thrown out. Things can happen on boot so changing the boot order is the proper answer here. Again, removing the CMOS battery will affect the system. https://www.technewstoday.com/motherboard-cmos-battery-dead/#:~:text=Removing%20the%20CMOS%20battery%20will,time%20you%20start%20your%20computer.

Answer C would be a breach of integrity. By altering the boot.sys, you are changing possible evidence. Correct answer would be B.

I believe, B should be the answer as modifying boot.sys will contaminate the evidence.

B is the as CMOS contains the configuration to start up the system

Answer is B