EC-CouncilEC-Council
312-49 · Question #30
312-49 Question #30: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49 to reveal the answer and full explanation for question #30. The question stem and answer options stay visible for context.
Submitted by rachelw· Apr 18, 2026Computer Forensics in Today's World
Question
What is the "Best Evidence Rule"?
Options
- AIt states that the court only allows the original evidence of a document, photograph, or recording
- BIt contains system time, logged-on user(s), open files, network information, process information,
- CIt contains hidden files, slack space, swap file, index.dat files, unallocated clusters, unused
- DIt contains information such as open network connection, user logout, programs that reside in
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Best Evidence Rule#Legal Aspects of Forensics#Evidence Admissibility#Forensic Principles