Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?

Depending upon the Jurisdictional areas, different laws apply to different incidents.
Which of the following law is related to fraud and related activity in connection with computers?

Sectors in hard disks typically contain how many bytes?

POP3 is an Internet protocol, which is used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?

This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.