EC-Council
312-49 · Question #202
A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants
Sign in or unlock 312-49 to reveal the answer and full explanation for question #202. The question stem and answer options stay visible for context.
Submitted by tunde_lagos· Apr 18, 2026Computer Forensics Investigation Process
Question
A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?
Options
- ASearching for evidence themselves would not have any ill effects
- BSearching could possibly crash the machine or device
- CSearching creates cache files, which would hinder the investigation
- DSearching can change date/time stamps
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Evidence preservation#Incident response#Digital forensics best practices