Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

Both Civil and Criminal Investigations

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

Speculation or opinion as to the cause of the incident

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

A text file deleted from C drive in fifth sequential order

A text file deleted from C drive in sixth sequential order

A text file deleted from C drive in fifth sequential order

A text file copied from D drive to C drive in fifth sequential order

A text file copied from C drive to D drive in fifth sequential order

What must an attorney do first before you are called to testify as an expert?

Qualify you as an expert witness

Read your curriculum vitae to the jury

Prove that the tools you used to conduct your examination are perfect

Which of the following statements is incorrect when preserving digital evidence?

Turn on the computer and extract Windows event viewer log files

Verify if the monitor is in on, off, or in sleep mode

Turn on the computer and extract Windows event viewer log files

Remove the plug from the power router or modem

Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:

Manufacturer Identification Code (MIC)

Rusty, a computer forensics apprentice, uses the command nbtstat -c while analyzing the network information in a suspect system. What information is he looking for?

Contents of the NetBIOS name cache

Contents of the network routing table

Contents of the NetBIOS name cache

Gary, a computer technician, is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation does this case require?

Both Criminal and Administrative Investigation

The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

[Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration:/export/home/live/ap/htdocs/test

http://victim.com/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+C:\Winnt\system32\Logfiles\W3SVC1

[Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration:/export/home/live/ap/htdocs/test

127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326

127.0.0.1 - - [10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0" 200 2326

ECCouncil 312-49v10 Practice Test 11 - Free Online Exam Prep & Questions

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 312-49v10 Practice Test 11

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests