Nobles, a digital forensic examiner for a government agency, is conducting a criminal investigation of Lucas, a construction company executive, for alleged bribery of foreign officials Nobles obtains a court order authorizing him to seize Lucas’s personal computer for forensic examination .
Which of the following is the MOST ACCURATE statement?
A . If Lucas’s computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data
B. If Lucas’s computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interlace.
C. If Lucas’s computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
D. If Lucas’s computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process
Answer: C
Latest CFE Investigation Dumps Valid Version with 100 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund