QUESTION: 33

What does machine, an essential part of the coroner's toolkit do?

It is a tool specific to the MAC OS and forms a core component of the toolkit
It traverses the file system and produces a listing of all files based on the modification, access and change timestamps
The tools scans for i-node information, which is used by other tools in the tool kit
It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

Answer(s): B

Show Answer Next Question

QUESTION: 34

When examining a file with a Hex Editor, what space does the file header occupy?

the first several bytes of the file
the last several bytes of the file
none, file headers are contained in the FAT
one byte at the beginning of the file

Answer(s): A

Show Answer Next Question

QUESTION: 35

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

chain of custody
law of probability
rules of evidence
policy of separation

Answer(s): A

Show Answer Next Question

QUESTION: 36

E-mail logs contain which of the following information to help you in your investigation?

attachments sent with the e-mail message
contents of the e-mail message
user account that was used to send the message
unique message identifier
date and time the message was sent

Answer(s): A,B,C,E

Show Answer Next Question

Free EC-Council EC0-349 Exam Braindumps

QUESTION: 33

QUESTION: 34

QUESTION: 35

QUESTION: 36

EC0-349 Exam Discussions & Posts