(D) With the hard drive in the suspect PC, check the date and time in the system's CMOS
This preserves the system state and allows access to accurate date/time information.
Refer to Question #47 Topic 1
If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.
Can someone explain why this wouldn't be D? As system time/date is considered volatile data, why would one remove a hard disk first before obtaining it?
Technically, CMOS is powered by a small battery. "Nonvolatile BIOS memory refers to a small memory on PC motherboards that is used to store BIOS settings. It is traditionally called CMOS RAM because it uses a volatile, low-power complementary metal-oxide-semiconductor (CMOS) SRAM (such as the Motorola MC146818 or similar) powered by a small "CMOS" battery when system and standby power is off."
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
044f354
2 months agoElb
10 months, 3 weeks agotopbarry
1 year, 5 months agot3stk1ng
3 years agoAspiringScriptKiddie
3 years, 2 months agojjweust
3 years ago