Suggested Answer:B🗳️
A memory dump can be admitted as evidence if it acts merely as a statement of fact. A system dump is not considered hearsay because it is used to identify the state of the system, not the truth of the contents. The exclusionary rule mentions that evidence must be gathered legally or it can't be used. This choice is a distracter. Source: ANDRESS, Mandy, Exam Cram CISSP, Coriolis, 2001, Chapter 10: Law, Investigation, and Ethics (page 187).
A. Because it is used to demonstrate the truth of the contents.
A memory dump is a copy of the contents of a computer's memory at a specific point in time, and it can be admissible as evidence in court because it is used to demonstrate the truth of the contents. Memory dumps can be used to show what was in the memory at the time of an incident, including any malware or command lines used, and what processes and data were in memory. It can also help to identify the state of the system and processes running on it at the time of the incident. The exclusionary rule is a legal principle that prevents evidence obtained illegally or in violation of the defendant's rights from being used in court. A memory dump is not related to this rule.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
kmanb
8 months agobradseth
7 months, 2 weeks ago