試題詳解

13.In which of the following areas is evidence most likely to be lost if a compromised system is shut down before evidence collection is complete?
(A)Raw disk blocks
(B) Memory contents
(C) File system information
(D) USB drivers