ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 312-49 All Questions

View all questions & answers for the 312-49 exam
Go to Exam

Exam 312-49 topic 1 question 87 discussion

Actual exam question from ECCouncil's 312-49
Question #: 87
Topic #: 1
[All 312-49 Questions]

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

  • A. Recycle Bin
  • B. MSDOS.sys
  • C. BIOS
  • D. Case files
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by MrRubi at July 30, 2022, 11:04 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Ceh2024
8 months, 1 week ago
Selected Answer: D
It should be a case file. We use the write-blocker to avoid the contamination of the case file
upvoted 1 times
...
MrRubi
1 year, 9 months ago
Anyone has a justification for this?
upvoted 1 times
Tonymoo
1 year, 7 months ago
I think that would be one of the first points of call for evidence - deleted data that has not been emptied from the Recycle bin yet.
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago