Computer Hacking Forensic Investigator (CHFI) — Question 4

If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

Answer options

• A. deltree command
• B. CMOS
• C. Boot.sys
• D. Scandisk utility

Correct answer: B

Explanation

The correct answer is B, CMOS, as modifying the CMOS settings allows you to change the boot order to avoid booting from the hard drive. The deltree command (A) is used to delete directories, Boot.sys (C) is a system file for booting, and Scandisk (D) is a utility for checking disk integrity, none of which are relevant to preventing data alteration during startup.