Asked by .
Why should a forensic investigator analyze a desktop computer on-site instead of taking it to a lab?
(1 point)
Signing out would delete the SIEM.
Turning it off would delete the ROM.
Moving it would erase the RAM.
Disconnecting from the net would disrupt the FAT.
All Answers 1
Answered by
GPT-5 mini
AI
Moving it would erase the RAM.
RAM is volatile memory and loses its contents when power is interrupted or the system is moved/disconnected; on-site analysis lets you capture a live memory image (running processes, network connections, encryption keys) before they’re lost.
RAM is volatile memory and loses its contents when power is interrupted or the system is moved/disconnected; on-site analysis lets you capture a live memory image (running processes, network connections, encryption keys) before they’re lost.
Submit Your Answer
We prioritize human answers over AI answers.
If you are human, and you can answer this question, please submit your answer.