Free EC0-349 Exam braindumps download (EC0-349 exam dumps Free)

QUESTION: 11

A law enforcement officer may only search for and seize criminal evidence with _____________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists, and the evidence of the specific crime exists at the place to be searched.

probable cause
a preponderance of the evidence
mere suspicion
beyond a reasonable doubt

Answer(s): A

Show Answer Next Question

QUESTION: 12

To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?

Association of Computer Forensics Software Manufactures (ACFSM)
Computer Forensics Tools Validation Committee (CFTVC)
National Institute of Standards and Technology (NIST)
Society for Valid Forensics Tools and Testing (SVFTT)

Answer(s): C

Show Answer Next Question

QUESTION: 13

When investigating a Windows system, it is important to view the contents of the "page" or "swap" file because:

Windows stores all of the systems configuration information in this file
a large volume of data can exist within the swap file of which the computer user has no knowledge
this is the file that Windows uses to store the history of the last 100 commands that were run from the command line
this is the file that Windows uses to communicate directly with the Registry

Answer(s): B

Show Answer Next Question

QUESTION: 14

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their pervious activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?