Computer Hacking Forensic Investigator (CHFI v10) — Question 60

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

Answer options

• A. Recycle Bin
• B. MSDOS.sys
• C. BIOS
• D. Case files

Correct answer: A

Explanation

The correct answer is A, as Windows will automatically write temporary files and changes to the Recycle Bin upon startup. The other options, such as MSDOS.sys and BIOS, are not affected in the same way by Windows booting, and Case files do not pertain to the operating system's file handling during startup.