EC-Council
312-49V11 · Question #168
312-49V11 Question #168: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49V11 to reveal the answer and full explanation for question #168. The question stem and answer options stay visible for context.
Question
In a computer forensics investigation, an investigator is dealing with a system that has been recently shut down. The data they need is of a non-volatile nature. Which type of data acquisition methodology should the investigator adopt in this scenario and why?
Options
- AThe investigator should not perform any data acquisition as the system is already powered off
- BThe investigator should use either live or dead data acquisition as both methods can collect non-
- CThe investigator should use live data acquisition since it is intended to capture dynamic data from
- DThe investigator should use dead data acquisition because it is designed to collect unaltered data
Unlock 312-49V11 to see the answer
You've previewed enough free 312-49V11 questions. Unlock 312-49V11 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.