CHFI EXAM QUESTIONS With Complete Solutions
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk? A. All virtual memory will be deleted. B. The wrong partition may be set to active. C. This action can corrupt the disk. D. The computer will be set in a constant reboot state. correct answer: C Which is a standard procedure to perform during all computer forensics investigations? A. With the hard drive in the suspect PC, check the date and time in the system CMOS. B. With the hard drive removed from the suspect PC, check the date and time in the system CMOS. C. With the hard drive in the suspect PC, check the date and time in the File Allocation Table. D. With the hard drive removed from the suspect PC, check the date and time in the system RAM. correct answer: B If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure? A. Keep the device powered on. B. Turn off the device immediately. C. Remove the battery immediately. D. Remove any memory cards immediately. correct answer: A When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having? A. One
Información del documento
- Subido en
- 8 de julio de 2023
- Número de páginas
- 56
- Escrito en
- 2022/2023
- Tipo
- Examen
- Contiene
- Preguntas y respuestas
