Scan QR code or get instant email to install app
Question:
In order to preserve the system for forensic purposes, Jimmy must ensure that it remains unchanged. Switching off the system can cause a loss of information stored in the memory, which may be important for the investigation. Similarly, removing the drive while the system is operational may result in data loss. Instead, it might be necessary to capture a live image of the machine and its memory. Allowing users to work on the system can lead to changes, which could negatively impact Jimmy's ability to perform a forensic investigation.
Comments