A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?
Answer(s): C
Why should you never power on a computer that you need to acquire digital evidence from?
Answer(s): A
What is the slave device connected to the secondary IDE controller on a Linux OS referred to?
Answer(s): B
What will the following command accomplish? dd if=/dev/xxx of=mbr.backup bs=512 count=1
Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync
Post your Comments and Discuss EC-Council 312-49 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-49 content, but please register or login to continue.