QUESTION: 101

What information do you need to recover when searching a victim’s computer for a crime committed with specific e-mail message?

Internet service provider information
E-mail header
Username and password
Firewall log

Answer(s): B

Reveal Solution Next Question

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
A simple DOS copy will not include deleted files, file slack and other information
There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

Answer(s): C

Reveal Solution Next Question

QUESTION: 103

You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

the attorney-work-product rule
Good manners
Trade secrets
ISO 17799

Answer(s): A

Reveal Solution Next Question

QUESTION: 104

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

the File Allocation Table
the file header
the file footer
the sector map

Answer(s): B

Reveal Solution Next Question

Free 312-49 Exam Braindumps (page: 26)

QUESTION: 101

QUESTION: 102

QUESTION: 103

QUESTION: 104