ECCouncil 312-49v9 - Computer Hacking Forensic Investigator (v9)
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.
The objective of this act was to protect consumers’ personal financial information held by financial institutions and their service providers.
What does mactime, an essential part of the coroner's toolkit do?
As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
In a FAT32 system, a 123 KB file will use how many sectors?
When you carve an image, recovering the image depends on which of the following skills?
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
What is the target host IP in the following command?
You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject’s computer. You inform the officer that you will not be able to comply with that request because doing so would:
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
What is kept in the following directory? HKLM\SECURITY\Policy\Secrets
What happens when a file is deleted by a Microsoft operating system using the FAT file system?
Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?
The MD5 program is used to:
