When investigating a Windows system, it is important to view the contents of the "page" or "swap" file because:
Answer(s): B
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their pervious activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
Answer(s): D
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
Answer(s): C
If you plan to startup a suspect's computer, you must modify the _____________to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.
Answer(s): A
Post your Comments and Discuss EC-Council EC0-349 exam prep with other Community members:
We’re offering these study questions to support your success. The least you can do? Drop a useful comment about each question. Help others. Build the community.