問題文
A host was powered off by a responder before any collection. The investigation later needs to know which processes were running and what they had open. Which two facts about that situation are correct? (Select two.)
選択肢
- The host can be restarted to recover it.
- Some of it can be approximated from other sources, such as network records of the connections that were open at the time.
- That information existed only while the machine was running and is now unavailable from the host.
- The information was never needed because the disk contains everything.
- The information can be recovered from the disk image, because an operating system writes the complete list of running processes and their open handles to a file at shutdown and that file contains everything the live examination would have shown.