QuestionQ132Verified/Incident Response and RecoveryCopy linkReport a problemAsk AstroTutorSave questionWhy might a memory dump be admissible as evidence in a court proceeding?ABecause it is used to demonstrate the truth of the contents.BBecause it is used to identify the state of the system.CBecause the state of the memory cannot be used as evidence.DBecause of the exclusionary rule.Show AnswerAnswerExplanationA memory dump can establish the state of a computer system at a particular time, such as running processes, network connections, and data held in volatile memory. It is used to identify that system state rather than to prove the truth of the contents as assertions.Show comments3Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion