List of questions
Related questions
Question 387 - CISM discussion
A forensic examination of a PC is required, but the PC has been switched off. Which of the following should be done FIRST?
A.
Perform a backup of the hard drive using backup utilities.
B.
Perform a bit-by-bit backup of the hard disk using a write-blocking device
C.
Perform a backup of the computer using the network
D.
Reboot the system using third-party forensic software in the CD-ROM drive
Your answer:
0 comments
Sorted by
Leave a comment first