During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:
Answer(s): A
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?
Answer(s): B
When investigating a Windows system, it is important to view the contents of the "page" or "swap" file because:
Answer(s): C
What does the superblock in Linux define?
The _____________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.
Post your Comments and Discuss EC-Council EC0-349 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the EC0-349 content, but please register or login to continue.