In a computer forensics investigation, an investigator is dealing with a system that has been recently shut down. The data they need is of a non-volatile nature. Which type of data acquisition methodology should the investigator adopt in this scenario and why?

A. The investigator should not perform any data acquisition as the system is already powered off

B. The investigator should use either live or dead data acquisition as both methods can collect non-volatile data from the system

C. The investigator should use live data acquisition since it is intended to capture dynamic data from the computer's memory, caches, and registries

D. The investigator should use dead data acquisition because it is designed to collect unaltered data from storage devices such as hard drives and USB thumb drives








 

Suggested Answer: D

Community Answer: D



This question is in 312-49V10 EC-Council Computer Hacking Forensic Investigator (CHFI) v10 Exam
For getting EC-Council Computer Hacking Forensic Investigator (CHFI) Certificate







Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by EC-Council. 
Trademarks, certification & product names are used for reference only and belong to EC-Council.
The website does not contain actual questions and answers from EC-Council's Certification Exams.