Eccouncil Exam 312-49 Topic 1 Question 78 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 78
Topic #: 1

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

AAutomate Collection from image files

BAvoiding copying data from the boot partition

CAcquire data from host-protected area on a disk

DPrevent Contamination to the evidence drive

Show Suggested Answer

Suggested Answer: A

by Dottie at Mar 22, 2025, 02:46 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

3 days ago

Write-blocking is crucial to prevent any accidental modifications to the evidence drive. Option D is the way to go!

upvoted 0 times

...

7 days ago

I also believe the answer is D. It's important to maintain the integrity of the evidence during acquisition.

upvoted 0 times

...

8 days ago

I agree with Desiree, using a hardware write-blocking device is crucial to prevent any contamination to the evidence drive.

upvoted 0 times

...

8 days ago

I think the answer is D) Prevent Contamination to the evidence drive.

upvoted 0 times

...