Free EC0-349 Exam Braindumps
EC0-349 ECCouncil Computer Hacking Forensic Investigator Questions 31–35 (page: 8)

You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

The offset in a hexadecimal code is:

What does machine, an essential part of the coroner's toolkit do?

When examining a file with a Hex Editor, what space does the file header occupy?

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?