Free EC0-349 Exam Braindumps
EC0-349 ECCouncil Computer Hacking Forensic Investigator Questions 121–125 (page: 26)

What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

Which of following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

You are working as computer forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firms employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

You have completed a forensic investigation case. You would like to destroy the data contained in various hard disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disks? (Recovery of data should be impossible)