ECCouncil Computer Hacking Forensic Investigator (V9)

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

UEFI is a specification that defines a software interface between an OS and platform firmware.

Where does this interface store information about files present on a disk?

George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan.

Why would a scanner like Nessus is not recommended in this situation?

Which of the following Perl scripts will help an investigator to access the executable image of a process?

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

Bob works as information security analyst for a big finance company. One day, the anomaly-based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the main web server was occurring.

What kind of attack is it?

Kyle is performing the final testing of an application he developed for the accounting department.
His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command. What is he testing at this point?

#include #include int main(int argc, char
*argv[]) { char buffer[10];
if (argc < 2) { fprintf (stderr, "USAGE: %s string\n", argv[0]);
return 1; }
strcpy(buffer, argv[1]);
return 0; }

You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printer out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

You have been given the task to investigate web attacks on a Windows-based server.

Which of the following commands will you use to look at the sessions the machine has opened with other systems?

What does the 56.58.152.114(445) denote in a Cisco router log?
Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35
(8084) -> 56.58.152.114(445), 1 packet