13.In which of the following areas is evidence most likely to be lost if a compromised system is shut down before evidence collection is complete?
(A)Raw disk blocks
(B) Memory contents
(C) File system information
(D) USB drivers

答案：登入後查看
統計： A(0), B(1), C(1), D(0), E(0) #2849685