ECCouncil 412-79 - EC-Council Certified Security Analyst (ECSA)
You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?
It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
Area density refers to:
Which of the following should a computer forensics lab used for investigations have?
When cataloging digital evidence, the primary goal is to:
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?
What TCP/UDP port does the toolkit program netstat use?
Corporate investigations are typically easier than public investigations because:
Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:
