nerdexam
GIAC

GCFE · Question #103

Why is live data acquisition important in some forensic investigations?

The correct answer is B. It captures volatile data like RAM contents, which can be lost on shutdown. See the full explanation below for the reasoning.

Question

Why is live data acquisition important in some forensic investigations?

Options

  • AIt helps recover data after a system crash
  • BIt captures volatile data like RAM contents, which can be lost on shutdown
  • CIt speeds up the forensic imaging process
  • DIt logs hardware changes

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    85% (22)
  • C
    4% (1)
  • D
    8% (2)

Community Discussion

No community discussion yet for this question.

Full GCFE Practice