EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 521:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed

  B. It can find bad sectors on the hard drive

  C. It can search slack space

  D. It can find files hidden within ADS

  Correct Answer: C

• Question 522:

  You are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect house after aYou are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect? house after a warrant was obtained and they located a floppy disk in the suspect bedroom. The disk contains several files, but they appear to be passwordwarrant was obtained and they located a floppy disk in the suspect? bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you could use to obtain the password?

  A. Limited force and library attack

  B. Brute force and dictionary attack

  C. Maximum force and thesaurus attack

  D. Minimum force and appendix attack

  Correct Answer: B

• Question 523:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn? denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?

  A. The year the evidence was taken

  B. The sequence number for the parts of the same exhibit

  C. The initials of the forensics analyst

  D. The sequential number of the exhibits seized

  Correct Answer: D

• Question 524:

  During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

  A. C:\Program Files\Exchsrvr\servername.log

  B. D:\Exchsrvr\Message Tracking\servername.log

  C. C:\Exchsrvr\Message Tracking\servername.log

  D. C:\Program Files\Microsoft Exchange\srvr\servername.log

  Correct Answer: A

• Question 525:

  A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file?its contents. The picture? quality is not degraded at all from this process. What kind of picture is this file?

  A. Raster image

  B. Vector image

  C. Metafile image

  D. Catalog image

  Correct Answer: B

• Question 526:

  Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

  A. Two

  B. One

  C. Three

  D. Four

  Correct Answer: A

• Question 527:

  The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term?

  A. Detection

  B. Hearsay

  C. Spoliation

  D. Discovery

  Correct Answer: D

• Question 528:

  Paul is a computer forensics investigator working for Tyler and Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers?hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

  A. Place PDA, including all devices, in an antistatic bag

  B. Unplug all connected devices

  C. Power off all devices if currently on

  D. Photograph and document the peripheral devices

  Correct Answer: D

• Question 529:

  What happens when a file is deleted by a Microsoft operating system using the FAT file system?

  A. The file is erased and cannot be recovered

  B. The file is erased but can be recovered partially

  C. A copy of the file is stored and the original file is erased

  D. Only the reference to the file is removed from the FAT and can be recovered

  Correct Answer: D

• Question 530:

  In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

  A. The ISP can investigate anyone using their service and can provide you with assistance

  B. The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

  C. The ISP cannot conduct any type of investigations on anyone and therefore cannot assist you

  D. ISPs never maintain log files so they would be of no use to your investigation

  Correct Answer: B