Exam4Training

Which of the following is the BEST place to acquire evidence to perform data carving?

During an investigation, a security analyst identified machines that are infected with malware the antivirus was unable to detect.

Which of the following is the BEST place to acquire evidence to perform data carving?
A . The system memory
B . The hard drive
C . Network packets
D . The Windows Registry

Answer: A

Explanation:

Reference:

https://resources.infosecinstitute.com/memory-forensics/#gref https://www.computerhope.com/jargon/d/data-carving.htm

Latest CS0-002 Dumps Valid Version with 220 Q&As

Latest And Valid Q&A | Instant Download | Once Fail, Full Refund

Exit mobile version