312-49 Question #410: Real Exam Question with Answer & Explanation

The correct answer is E: boot.ini. The OS isn't specified, but if this was a Windows OS, then this would be boot.ini The answer is CMOS. The startup of a computer is the boot sequence, and the boot sequence is defined in the CMOS. The common occurrence is to boot off a floppy, and you need to see that the floppy (

Submitted by skyler.x· Apr 18, 2026Computer Forensics Investigation Process

Question

If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

Options

Adeltree command
BCMOS
CBoot.sys
DScandisk utility
Eboot.ini

Explanation

The OS isn't specified, but if this was a Windows OS, then this would be boot.ini The answer is CMOS. The startup of a computer is the boot sequence, and the boot sequence is defined in the CMOS. The common occurrence is to boot off a floppy, and you need to see that the floppy (usually the A drive) is first in the sequence. If you don't, and the hard drive is first, then booting the system wil boot the hard drive and alter the evidence.

Topics

#Forensic Preservation#Boot Process#Data Contamination#Evidence Integrity

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions