Free EC0-349 Exam braindumps download (EC0-349 exam dumps Free)

QUESTION: 126

One way to identify the presence of hidden partitions on a suspects hard drive is to:

it is not possible to have hidden partitions on a hard drive
examine the FAT and identify hidden partitions by noting an H in the Partition Type field
add up the total size of all known partitions and compare it to the total size of the hard drive
examine the LILO and note an H in the Partition Type field

Answer(s): C

QUESTION: 127

What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

a reserved file
an encrypted file
a compressed file
a data streamfile

Answer(s): D

Show Answer Next Question

QUESTION: 128

Sectors in hard disks typically contain how many bytes?

512
2048
256
1024

Answer(s): A

Show Answer Next Question

QUESTION: 129

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence procedures are not important unless you work for a law enforcement agency
evidence in a civil case must be secured more tightly than in a criminal case
evidence must be handled in the same way regardless of the type of case
evidence in a criminal case must be secured more tightly than in a civil case

Answer(s): C

Show Answer Next Question

QUESTION: 130

What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

offset
rootkit
steganography
key escrow

Answer(s): C

Show Answer Next Question

Free EC0-349 Exam Braindumps EC0-349 ECCouncil Computer Hacking Forensic Investigator Questions 126–130 (page: 27)

QUESTION: 126

QUESTION: 127

QUESTION: 128

QUESTION: 129

QUESTION: 130

Free EC0-349 Exam Braindumps
EC0-349 ECCouncil Computer Hacking Forensic Investigator Questions 126–130 (page: 27)