Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-49v10

EC-Council 312-49v10 Exam Questions
Computer Hacking Forensic Investigator (Page 24 )

Updated On: 17-Feb-2026
Page 24 of 138
PDF with 831 Questions

To preserve digital evidence, an investigator should ____________________.

  1. Make two copies of each evidence item using a single imaging tool
  2. Make a single copy of each evidence item using an approved imaging tool
  3. Make two copies of each evidence item using different imaging tools
  4. Only store the original evidence item

Answer(s): C



Pro ling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a pro le of the incident?

  1. The manufacturer of the system compromised
  2. The logic, formatting and elegance of the code used in the attack
  3. The nature of the attack
  4. The vulnerability exploited in the incident

Answer(s): B



Printing under a Windows Computer normally requires which one of the following les types to be created?

  1. EME
  2. MEM
  3. EMF
  4. CME

Answer(s): C



An Expert witness give an opinion if:

  1. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
  2. To de ne the issues of the case for determination by the nder of fact
  3. To stimulate discussion between the consulting expert and the expert witness
  4. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

Answer(s): A



When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

  1. Automate Collection from image les
  2. Avoiding copying data from the boot partition
  3. Acquire data from host-protected area on a disk
  4. Prevent Contamination to the evidence drive

Answer(s): D






Post your Comments and Discuss EC-Council 312-49v10 exam dumps with other Community members:

Join the 312-49v10 Discussion