CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Computer Hardware and Software
During a forensic seizure of a laptop in Pune, an investigator must preserve evidence in the order of volatility. Which item should ordinarily be captured first because it is lost soonest on power-off?
RAM and CPU registers should be captured first because they are the most volatile and are lost when power is removed. Hard disks, backup tapes and printed papers persist, so they are collected later in the order of volatility.
- AContents of the hard disk
- BArchived backup tapes
- CContents of RAM and CPU registersCorrect
- DPrinted documents in the office
Explanation
Evidence is collected from most volatile to least volatile. CPU registers and RAM vanish on shutdown, whereas disk contents, backups and paper persist. Capturing the disk first risks losing live memory data such as running processes.
Did you get it right without looking?
One question tells you little. A timed set on Computer Hardware and Software shows your real accuracy, how long you take and where you lose marks.
More Computer Hardware and Software questions
- Under the Information Technology Act, 2000, tampering with computer source code is an offence when the code is required to be kept or mainta…
- In a computer's von Neumann-style architecture, which component fetches instructions from memory, decodes them and directs the other units t…
- A company secretary is told that the server's CPU fetches an instruction from memory, decodes it and then carries it out. Which component of…
- A systems administrator installs a small program built into a hardware device, such as a router's permanent control software stored in non-v…
- Under the Information Technology Act, 2000, a person who dishonestly or fraudulently tampers with computer source code that the law requires…
- A programmer writes a routine in a language whose statements use mnemonics such as ADD and MOV, one mnemonic usually mapping to one machine …