ECCouncil 312-49v10 - Computer Hacking Forensic Investigator (CHFI-v10)

The investigator wants to examine changes made to the system’s registry by the suspect program. Which of the following tool can help the investigator?

Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

How will you categorize a cybercrime that took place within a CSP’s cloud environment?

How many times can data be written to a DVD+R disk?

What must an investigator do before disconnecting an iPod from any type of computer?

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

Which of the following techniques can be used to beat steganography?

Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ?

Which of the following refers to the process of the witness being questioned by the attorney who called the latter to the stand?

NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

Which US law does the interstate or international transportation and receiving of child pornography fall under?

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at the sessions the machine has opened with other systems?