Which is a standard procedure to perform during all computer forensics investigations?

with the hard drive removed from the suspect PC, check the date and time in the system's CMOS
with the hard drive in the suspect PC, check the date and time in the File Allocation Table
with the hard drive removed from the suspect PC, check the date and time in the system's RAM
with the hard drive in the suspect PC, check the date and time in the system's CMOS

Answer(s): A

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

Answer(s): A,C,D,E

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

Answer(s): D

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence must be handled in the same way regardless of the type of case
evidence procedures are not important unless you work for a law enforcement agency
evidence in a criminal case must be secured more tightly than in a civil case
evidence in a civil case must be secured more tightly than in a criminal case

Answer(s): C

Free 312-49 Exam Braindumps (page: 9)