Free EC0-349 Exam braindumps download (EC0-349 exam dumps Free)

QUESTION: 146

When examining a file with a Hex Editor, what space does the file header occupy?

one byte at the beginning of the file
the first several bytes of the file
none, file headers are contained in the FAT
the last several bytes of the file

Answer(s): B

Show Answer Next Question

QUESTION: 147

Which of the following should a computer forensics investigations lab have?

an entry log
restricted access
isolation
open access

Answer(s): B

Show Answer Next Question

QUESTION: 148

Which is a standard procedure to perform during all computer forensics investigations?

with the hard drive in the suspect PC, check the date and time in the File Allocation Table
with the hard drive in the suspect PC, check the date and time in the systems CMOS
with the hard drive removed from the suspect PC, check the date and time in the systems RAM
with the hard drive removed from the suspect PC, check the date and time in the systems CMOS

Answer(s): D

Show Answer Next Question

QUESTION: 149

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?