If a computer is turned off during a crime scene investigation, what can happen to unsaved data?

Prepare for the EC-Council Certified Incident Handler Test with an interactive quiz. Study with flashcards, MCQs, hints, and explanations. Ace your test!

When a computer is turned off during a crime scene investigation, any unsaved data that was in memory at the time of shutdown can be lost permanently. This is because once a computer is powered off, the volatile memory (RAM) that holds temporary data is cleared. If the data was not written to a hard drive or another storage medium before the shutdown, it cannot be recovered after the power is removed.

In contrast, unsaved data would typically be lost because it has not been committed to a non-volatile storage medium. Therefore, the information held in RAM disappears, making it impossible for investigators to retrieve that data after the shutdown. This emphasizes the importance of ensuring that computers involved in investigations remain powered on and untouched until data preservation steps can be taken.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy