Exam 312-49v11 Topic 3 Question 27 Discussion

Actual exam question for EC-COUNCIL's 312-49v11 exam
Question #: 27
Topic #: 3
Laura, a CHFI certified investigator, has been brought in to investigate a major incident at a software development company. A disgruntled employee had injected malicious code into several core products, causing significant damage to the company's reputation and bottom line. Laura had to decide the best way to gather evidence from the suspect's heavily used workstation, which has been running continuously for weeks and may contain critical evidence in RAM. What data acquisition strategy should Laura adopt to maximize the evidence gathered?

Suggested Answer: C Vote an answer

Since the workstation is running and may contain critical evidence in RAM, live acquisition allows capturing volatile data such as active processes and memory contents before it is lost.

by Jacob at Jul 15, 2026, 04:19 AM

Limited Time Offer

15%

Off

Get Premium 312-49v11 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10