What should you examine next in this case?

Posted by: Pdfprep Category: 312-49v9 Tags: , ,

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved.

What should you examine next in this case?
A . The registry
B . The swapfile
C . The recycle bin
D . The metadata

Answer: B

Leave a Reply

Your email address will not be published.