312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ145

Procedures and Methodology

Rachel, a computer forensic investigator, is examining a data-theft case at a law firm. She must capture and analyze the data on a particular computer believed to be the source of the data leak. However, the computer is continually used for critical tasks. Rachel is evaluating her data-acquisition options. Given the urgency of the situation, which type of data acquisition should Rachel select?

  • A Live Acquisition
  • B Remote Acquisition
  • C Static Acquisition
  • D Differential Acquisition
Explanation

Live acquisition collects evidence from an operating computer without taking it out of service, preserving volatile data such as memory contents, running processes, and active network connections while allowing critical work to continue.

Community Discussion

No comments yet. Be the first to start the discussion!