EC-CouncilEC-Council
312-49 · Question #214
312-49 Question #214: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49 to reveal the answer and full explanation for question #214. The question stem and answer options stay visible for context.
Submitted by hassan_iq· Apr 18, 2026Computer Forensics Investigation Process
Question
Which is a standard procedure to perform during all computer forensics investigations?
Options
- AWith the hard drive in the suspect PC, check the date and time in the system CMOSWith the hard
- BWith the hard drive removed from the suspect PC, check the date and time in the system
- CWith the hard drive in the suspect PC, check the date and time in the File Allocation Table
- DWith the hard drive removed from the suspect PC, check the date and time in the system
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Forensic procedures#Evidence preservation#System clock#Timeline correlation