QUESTION: 13

When investigating a Windows system, it is important to view the contents of the "page" or "swap" file because:

Windows stores all of the systems configuration information in this file
a large volume of data can exist within the swap file of which the computer user has no knowledge
this is the file that Windows uses to store the history of the last 100 commands that were run from the command line
this is the file that Windows uses to communicate directly with the Registry

Answer(s): B

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their pervious activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

The nature of the attack
The vulnerability exploited in the incident
The manufacture of the system compromised
The logic, formatting and elegance of the code used in the attack

Answer(s): D

Show Answer Next Question

QUESTION: 15

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

a disk editor
a firewall
a write-blocker
a protocol analyzer

Answer(s): C

Show Answer Next Question

QUESTION: 16

If you plan to startup a suspect's computer, you must modify the _____________to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

CMOS
Boot.sys
deltree command
Scandisk utility

Answer(s): A

Show Answer Next Question

Free EC-Council EC0-349 Exam Braindumps (page: 5)

QUESTION: 13

QUESTION: 14

QUESTION: 15

QUESTION: 16

EC0-349 Exam Discussions & Posts