GIAC
GCFE · Question #103
Why is live data acquisition important in some forensic investigations?
The correct answer is B. It captures volatile data like RAM contents, which can be lost on shutdown. See the full explanation below for the reasoning.
Question
Why is live data acquisition important in some forensic investigations?
Options
- AIt helps recover data after a system crash
- BIt captures volatile data like RAM contents, which can be lost on shutdown
- CIt speeds up the forensic imaging process
- DIt logs hardware changes
How the community answered
(26 responses)- A4% (1)
- B85% (22)
- C4% (1)
- D8% (2)
Community Discussion
No community discussion yet for this question.