Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-49

EC-Council 312-49 Exam
Computer Hacking Forensic Investigator (Page 19 )

Updated On: 9-Feb-2026
Page 19 of 108
PDF with 704 Questions

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

  1. EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
  2. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
  3. The EFS Revoked Key Agent can be used on the Computer to recover the information
  4. When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.

Answer(s): B



When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

  1. Recycle Bin
  2. MSDOS.sys
  3. BIOS
  4. Case files

Answer(s): A



You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you can use to obtain the password?

  1. Limited force and library attack
  2. Brute Force and dictionary Attack
  3. Maximum force and thesaurus Attack
  4. Minimum force and appendix Attack

Answer(s): B



When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?

  1. 202
  2. 404
  3. 505
  4. 909

Answer(s): B



Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  1. Use VMware to be able to capture the data in memory and examine it
  2. Give the Operating System a minimal amount of memory, forcing it to use a swap file
  3. Create a Separate partition of several hundred megabytes and place the swap file there
  4. Use intrusion forensic techniques to study memory resident infections

Answer(s): C






Post your Comments and Discuss EC-Council 312-49 exam prep with other Community members:

Join the 312-49 Discussion