When you carve an image, recovering the image depends on which of the following skills?

Recognizing the pattern of the header content

Recovering the image from a tape backup

Recognizing the pattern of a corrupt file

Recovering the image from the tape backup

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

The lowercase Greek Letter Sigma (s)

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge

Keep the information of file for later review

Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge

Present the evidence to the defense attorney

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.

EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information

When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.

The EFS Revoked Key Agent can be used on the Computer to recover the information

When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.

You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you can use to obtain the password?

Brute Force and dictionary Attack

Limited force and library attack

Brute Force and dictionary Attack

Maximum force and thesaurus Attack

Minimum force and appendix Attack

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Create a Separate partition of several hundred megabytes and place the swap file there

Use VMware to be able to capture the data in memory and examine it

Give the Operating System a minimal amount of memory, forcing it to use a swap file

Create a Separate partition of several hundred megabytes and place the swap file there

Use intrusion forensic techniques to study memory resident infections

What should you do when approached by a reporter about a case that you are working on or have worked on?

Refer the reporter to the attorney that retained you

Answer all the reporter's questions as completely as possible

Answer only the questions that help your case

A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?

They tampered with evidence by using it

They examined the actual evidence on an unrelated system

They attempted to implicate personnel without proof

They tampered with evidence by using it

They called in the FBI without correlating with the fingerprint data

When investigating a Windows System, it is important to view the contents of the page or swap file because:

A Large volume of data can exist within the swap file of which the computer user has no knowledge

Windows stores all of the systems configuration information in this file

This is file that windows use to communicate directly with Registry

A Large volume of data can exist within the swap file of which the computer user has no knowledge

This is the file that windows use to store the history of the last 100 commands that were run from the command line

Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual medi a. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?

Prepare the system for acquisition; Connect the target media; copy the media; Secure the evidence

Connect the target media; prepare the system for acquisition; Secure the evidence; Copy the media

Prepare the system for acquisition; Connect the target media; copy the media; Secure the evidence

Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media

Secure the evidence; prepare the system for acquisition; Connect the target media; copy the media

What does mactime, an essential part of the coroner's toolkit do?

It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

The tools scans for i-node information, which is used by other tools in the tool kit

It is too specific to the MAC OS and forms a core component of the toolkit

One way to identify the presence of hidden partitions on a suspect's hard drive is to:

Add up the total size of all known partitions and compare it to the total size of the hard drive

Examine the FAT and identify hidden partitions by noting an H in the partition Type field

Examine the LILO and note an H in the partition Type field

It is not possible to have hidden partitions on a hard drive

What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?

Internet service provider information

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

A simple DOS copy will not include deleted files, file slack and other information

A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum

Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file

A simple DOS copy will not include deleted files, file slack and other information

There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

This organization maintains a database of hash signatures for known software.

National Software Reference Library

International Standards Organization

Institute of Electrical and Electronics Engineers

National Software Reference Library

American National standards Institute

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy

Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned

Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment

Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy

Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies

During the course of a corporate investigation, you find that an Employee is committing a crime.Can the Employer file a criminal complaint with Police?

Yes, and all evidence can be turned over to the police

Yes, but only if you turn the evidence over to a federal law enforcement agency

No, because the investigation was conducted without following standard police procedures

No, because the investigation was conducted without warrant

To preserve digital evidence, an investigator should ____________________.

Make two copies of each evidence item using different imaging tools

Make two copies of each evidence item using a single imaging tool

Make a single copy of each evidence item using an approved imaging tool

Make two copies of each evidence item using different imaging tools

Only store the original evidence item

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

The logic, formatting and elegance of the code used in the attack

The manufacturer of the system compromised

The logic, formatting and elegance of the code used in the attack

The vulnerability exploited in the incident

An Expert witness give an opinion if:

The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

To define the issues of the case for determination by the finder of fact

To stimulate discussion between the consulting expert and the expert witness

To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

When using Windows acquisitions tools to acquire digital evidence, it is important to use a welltested hardware write-blocking device to:

Prevent Contamination to the evidence drive

Automate Collection from image files

Avoiding copying data from the boot partition

Acquire data from host-protected area on a disk

Prevent Contamination to the evidence drive

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

Microsoft Virtual Machine Identifier

You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

Throw the hard disk into the fire

Run the powerful magnets over the hard disk

Format the hard disk multiple times using a low level disk utility

Overwrite the contents of the hard disk with Junk data

You are working as a Computer forensics investigator for a corporation on a computer abuse case.You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:

Make you an agent of law enforcement

Write information to the subject's hard drive

ECCouncil 312-49v10 Practice Test 3 - Free Online Exam Prep & Questions

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Network Forensics

Data Recovery

Disaster Recovery

Computer Forensics

Comment (0)

ECCouncil 312-49v10 Practice Test 3

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests