Which is a standard procedure to perform during all computer forensics investigations?

The correct answer is B. With the hard drive removed from the suspect PC, check the date and time in the system. Standard forensic procedure requires removing the suspect hard drive before powering on the machine so that no evidence on the drive is altered. With the suspect drive removed, the investigator boots the system (often from a forensic boot media) and checks the BIOS/CMOS clock…

Submitted by hassan_iq· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AWith the hard drive in the suspect PC, check the date and time in the system CMOSWith the hard
BWith the hard drive removed from the suspect PC, check the date and time in the system
CWith the hard drive in the suspect PC, check the date and time in the File Allocation Table
DWith the hard drive removed from the suspect PC, check the date and time in the system

How the community answered

(50 responses)

A
4% (2)
B
86% (43)
C
8% (4)
D
2% (1)

Explanation

Standard forensic procedure requires removing the suspect hard drive before powering on the machine so that no evidence on the drive is altered. With the suspect drive removed, the investigator boots the system (often from a forensic boot media) and checks the BIOS/CMOS clock. This documents any time offset between the system clock and actual time, which is critical for accurately interpreting file timestamps during analysis. Checking the time with the suspect drive still installed risks modifying evidence. The File Allocation Table (FAT) does not store the system clock-it stores file metadata-so options C and D referencing FAT are incorrect.

Topics

#Forensic procedures#Evidence preservation#System clock#Timeline correlation

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice