Question 2 (1 point) Saved Why should a forensic investigator use nonvolatile data acquisition (SELECT 2)? Performing analysis on captured memory on a live system allows for faster analysis Performing analysis on the original hard drive can cause failure on the only evidence source Performing analysis on a hard drive with full disk encryption without the decryption key allows for data obfuscation Performing analysis on the original hard drive may cause unintended changes to the only evidence source Question 3 (1 point) Which of the following describe incident response CDs (SELECT 3)? Usually built on Linux distributions Saves time by consolidating multiple incident response and digital forensic tools into a single environment Designed to boot in read/write mode by default Designed to boot in read only mode