During a forensic examination, which procedure is performed with the hard drive removed?

• A. Check the CMOS time while the drive is connected
• B. Check the CMOS time with the drive removed
• C. Read the File Allocation Table with the drive removed
• D. Check the RAM contents

Answer: (B)

In forensic work, establishing an accurate timestamp often hinges on hardware-level data that isn’t tied to the suspect’s disk contents. The CMOS time reflects the system’s real-time clock stored on the motherboard. Checking this time with the drive removed ensures you’re reading the actual hardware clock without any possibility of the disk or an operating system influencing it. The other tasks aren’t feasible in this scenario: reading the File Allocation Table requires the disk present, and inspecting RAM contents typically involves a live memory capture rather than what you’d do with the drive removed. So, checking the CMOS time with the drive removed best fits this situation.