To avoid contaminating the suspect’s hard drive when starting up the computer, which hardware setting should be consulted?

To avoid contaminating the suspect’s hard drive when starting up the computer, which hardware setting should be consulted?

• A. Boot.ini
• B. CMOS
• C. Boot.sys
• D. Scandisk

Answer: (B)

Controlling the boot path at the firmware level is essential to prevent writes to the suspect’s drive. The CMOS stores BIOS/firmware settings, including the boot order and how devices are detected. By checking and adjusting these settings in CMOS, you can ensure the system boots from a trusted forensic medium (like a write-blocked USB/DVD) rather than the internal hard drive, minimizing the risk of contaminating or altering evidence. The other options are software components: Boot.ini is a Windows boot configuration file, Boot.sys is a Windows system file, and Scandisk is a disk-check utility, none of which govern hardware boot behavior.

Controlling the boot path at the firmware level is essential to prevent writes to the suspect’s drive. The CMOS stores BIOS/firmware settings, including the boot order and how devices are detected. By checking and adjusting these settings in CMOS, you can ensure the system boots from a trusted forensic medium (like a write-blocked USB/DVD) rather than the internal hard drive, minimizing the risk of contaminating or altering evidence. The other options are software components: Boot.ini is a Windows boot configuration file, Boot.sys is a Windows system file, and Scandisk is a disk-check utility, none of which govern hardware boot behavior.