CHFI v9
What is the size value of a nibble A. 0.5 bit B. 2 bits C. 0.5 byte D. 0.5 kilo byte
.5 byte
Which rule requires an original recording to be provided to prove the content of a recording? A. 1005 B. 1004 C. 1002 D. 1003
1002
Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame. A. 16-bit B. 32-bit C. 8-bit D. 24-bit
8-bit
What does the part of the log, "%SEC-6-IPACCESSLOGP," extracted from a Cisco router represent? A. A packet matching the log criteria for the given access list has been detected (TCP or UDP) B. Immediate action required messages C. Some packet-matching logs were missed because the access list log messages were rate limited, or no access list log buffers were available. D. The system was not able to process the packet because there was not enough room for all of the desired IP header options.
A packet matching the log criteria for the given access list has been detected (TCP or UDP)
Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote? A. %SystemDrive\logs\LogFiles B. SystemDrive\logs\LogFiles C. SystemDrive\inetpub\LogFiles D. %SystemDrive%\inetpub\logs\LogFiles
A text file deleted from C drive in fifth sequential order
What is cold boot (hard boot)? A. It is the process of shutting down a computer from a powered-on or on state B. It is the process of restarting a computer that is already in sleep mode C. It is the process of restarting a computer that is already turned on through the operating system D. It is the process of starting a computer from a powered-down or off state
A) It is the process of starting a computer from a powered-down or off state
What value of the "Boot Record Signature" is used to indicate that the boot-loader exists? A. AA00 B. A100 C. AA55 D. 00AA
AA55
Which of the following tool enables a user to reset his/her lost admin password in a Windows system? A. SmartKey Password Recovery Bundle Standard B. Active@ Password Changer C. Advanced Office Password Recovery D. Passware Kit Forensic
Active@ Password Changer
Buffer overflow vulnerability of web applications occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites ______. There are multiple forms of buffer overflow., including Heap Buffer Overflow and a Format String Attack. A. Adjacent bit blocks B. Adjacent memory locations C. Adjacent string locations D. Adjacent string locations
Adjacent Memory Locations
Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob's testimony in this case? A. Certification B. Justification C. Authentication D. Reiteration
Authentication
Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields? A. Automated Field Correlation B. Graph-Based Approach C. Rule-Based Approach D. Field-Based Approach
Automated Field Correlation
What is the purpose of using an obfuscator in malware? A. To convert the malware to a media file B. Execute malicious code in the system C. Propagate malware to other connected devices D. Avoid detection by security mechanisms
Avoid detection by security mechanisms
Which MySQL log file contains information on server start and stop? A. General query log file B. Binary log C. Slow query log file D. Error log file
Binary log
Which of the following technique creates a replica of an evidence media? A. Data Deduplication B. Data Extraction C. Backup D. Bit Stream Imaging
Bit Stream Imaging
You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a "simple backup copy" of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a "simple backup copy" will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding? A. Bit-stream copy B. Robust copy C. Full backup copy D. Incremental backup copy
Bit-stream copy
Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader). In which stage of the booting process do the bootloaders become active? A. Bootloader Stage B. BIOS Stage C. Kernel Stage D. BootROM Stage
Bootloader Stage
Gary a computer technician is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation is this. A. Criminal Investigation B. Administrative Investigation C. Civil Investigation D. Both Criminal and Administrative Investigation
Both criminal and investigation
Which password cracking technique uses every possible combination of character sets? A. Brute force attack B. Dictionary attack C. Rule-based attack D. Rainbow table attack
Brute force attack
A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect's available information but without any success. Which of the following tool can help the investigator to solve this issue? A. Cain & Abel B. Xplico C. Colasoft's Capsa D. Recuva
Cain & Abel
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it? A. Rogue access points B. Client mis-association C. Ad hoc associations D. MAC spoofing
Client mis-association
Rusty, a computer forensics apprentice, uses the command nbtstat -c while analyzing the network information in a suspect system. What information is he looking for? A. Contents of the network routing table B. Contents of the NetBIOS name cache C. Network connections D. Status of the network carrier
Contents of the NetBIOS name cache
Which of the following are small pieces of data sent from a website and stored on the user's computer by the user's web browser to track, validate, and maintain specific user information? A. Temporary Files B. Web Browser Cache C. Cookies D. Open files
Cookies
During forensics investigations, investigators tend to collect the system time at first and compare it with UTC. What does the abbreviation UTC stand for? A. Coordinated Universal Time B. Universal Computer Time C. Universal Time Coordination D. Universal Time for Computers
Coordinated Universal Time
What does 254 represent in ICCID 89254021520014515744 A. Issuer Identifier Number B. Industry Identifier Prefix C. Individual Account Identification Number D. Country Code
Country Code
Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness? A. Witness Examination B. Indirect Examination C. Cross Examination D. Direct Examination
Cross Examination
Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time. Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network? A. Multiple-platform correlation B. Cross-platform correlation C. Network-platform correlation D. Same-platform correlation
Cross-platform correlation
Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries." A. Man-in-the-Middle Attack B. DDoS C. Sniffer Attack D. Buffer Overflow
DDoS
Which of the following is NOT an anti-forensics technique? A. Data Deduplication B. Steganography C. Password Protection D. Encryption
Data Deduplication
Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses' testimony during federal legal proceedings? A. SWGDE & SWGIT B. Frye C. IOCE D. Daubert
Daubert
Which of the following tools will help the investigator to analyze web server logs? A. Towelroot B. LanWhoIs C. Deep Log Analyzer D. XRY LOGICAL
Deep Log Analyzer
Select the tool appropriate for finding dynamically linked lists off an application or malware. A. SysAnalyzer B. PEiD C. DependencyWalker D. ResourcesExtract
DependencyWalker
What does the 63.78.199.4(161) denotes in a Cisco router log? Mar 14 22:57:53.425 EST: %SEC-6-IPACCESSLOGP: list internet-inbound denied udp 66.56.16.77(1029) -> 63.78.199.4(161), 1 packet A. Destination IP address B. Login IP address C. Source IP address D. None of the above
Destination IP address
Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices. A. Drivespy B. fsutil C. Devcon D. Reg.exe
Devcon
Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company's domain controller goes down. From which system would you begin your investigation? A. Firewall B. IDS C. Domain Controller D. SIEM
Domain Controller
Which among the following search warrants allow the first responder to search and seize the victims computer components such as hardware, software, storage devices and documentation A. Service Provider Search Warrant B. Citizen Informant Search Warrant C. John Doe Search Warrant D. Electronic Storage Device Search Warrant
Electronic Storage Device Search Warrant
Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice? A. Installing malware analysis tools B. Enabling shared folders C. Using network simulation tools D. Isolating the host device
Enabling shared folders
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)? A. Content-Type header B. Errors-To header C. Mime-Version header D. Content-Transfer-Encoding header
Errors-To header
An expert witness is an ____________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense A. Crime scene spectator B. Ex criminal C. Government officer D. Expert advisor
Expert advisor
Which among the following U.S. laws requires financial institutions—companies that offer consumers financial products or services such as loans, financial or investment advice, or insurance—to protect their customers' information against security threats? A. FISMA B. GLBA C. SOX D. HIPAA
GLBA
Which of the following registry hive gives the configuration information about which application was used to open various files on the system? A. HKEY_USERS B. HKEY_CURRENT_CONFIG C. HKEY_LOCAL_MACHINE D. HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is: A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \ProfileList B. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\setup D. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \NetworkList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \ProfileList B.
Pagefile.sys is a virtual memory file used to expand the physical memory of a computer. Select the registry path for the page file: A. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management B. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management \PrefetchParameters C. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\System Management D. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Device Management
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password? A. Brute force attack B. Hybrid attack C. Rule-based attack D. Syllable attack
Hybrid attack
BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RBGQUAD array, information header, and image data. Which of the following element specifies the dimensions, the compression type, and color format for the bitmap. A. Information header B. The RGBQUAD array C. Header D. Image data
Information Header
As part of extracting the system data, Jenifer has used the netstat command. What does this reveal? A. Status of network hardware B. Net status of computer usage C. Information about network connections D. Information about netbios connections
Information about network connections
Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute in determining the addresses of data? A. Interface B. Sectors C. Heads D. Cylinder
Interface
Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\<USER SID>\ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name? A. RIYG6VR.doc is the name of the doc file deleted from the system B. It is file deleted from R drive C. It is a deleted doc file D. It is a doc file deleted in seventh sequential order
It is a deleted doc file
Data compression involves encoding the data to take up less storage space and less bandwidth for transmission. It helps in saving cost and high data manipulation in many business applications. Which data compression technique maintains data integrity? A. Lossy compression B. Lossless compression C. Speech encoding compression D. Lossy video compression
Lossless compression
Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups? A. Mount Count B. Superblock C. Master Boot Record (MBR) D. Inode table
Master Boot Record (MBR)
Which of the following is a database in which information about every file and directory on an NT File System (NTFS) volume is stored? A. GUID Partition Table B. Master File Table C. Volume Boot Record D. Master Boot Record
Master File Table
Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files? A. Microsoft Outlook B. Microsoft Outlook Express C. Mozilla Thunderbird D. Eudora
Microsoft Outlook Express
Which of the following is a list of recently used programs or opened files? A. Most Recently Used (MRU) B. GUID Partition Table (GPT) C. Recently Used Programs (RUP) D. Master File Table (MFT)
Most Recently Used (MRU)
Which of the following is a part of a Solid-State Drive (SSD)? A. Spindle B. Cylinder C. Head D. NAND-based flash memory
NAND-based flash memory
Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume A. FAT B. NTFS C. FAT32 D. EXT
NTFS
NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because: A. NTFS is a journaling file system B. FAT does not index files C. NTFS has lower cluster size space D. FAT is an older and inefficient file system
NTFS has lower cluster size space
Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file? A. Net sessions B. Net share C. Net file D. Net config
Net file
You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at the sessions the machine has opened with other systems? A. Net config B. Net use C. Net share D. Net sessions
Net sessions
Bob works as information security analyst for a big finance company. One day, the anomaly-based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the main web server was occurring. What kind of attack is it? A. APT B. Web application attack C. Network attack D. IDS attack
Network attack
Who is responsible for the following tasks? * Secure the scene and ensure that it is maintained in a secure state until the Forensic Team advises * Make notes about the scene that will eventually be handed over to the Forensic Team A. Local managers or other non-forensic staff B. Lawyers C. Non-forensics staff D. System administrators
Non-forensics staff
Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen? A. OpenGL/ES and SGL B. WebKit C. Surface Manager D. Media framework
OpenGL/ES and SGL
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory? A. Security misconfiguration B. Unvalidated input C. Parameter/form tampering D. Directory traversal
Parameter/form tampering
Lynne receives the following email: Dear [email protected]! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24 You have 24 hours to fix this problem or risk to be closed permanently! To proceed Please Connect >> My Apple ID Thank You The link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/ What type of attack is this? A. Email Spoofing B. Mail Bombing C. Email Spamming D. Phishing
Phishing
Which of the following files DOES NOT use Object Linking and Embedding (OLE) technology to embed and link to other objects? A. MS-office Word Document B. MS-office Word PowerPoint C. Portable Document Format D. MS-office Word OneNote
Portable Document Format (PDF)
An executive had leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system? A. Packet Analysis B. Real-Time Analysis C. Postmortem Analysis D. Malware Analysis
Postmortem Analysis
To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong? A. Post-investigation Phase B. Reporting Phase C. Investigation Phase D. Pre-investigation Phase
Pre-investigation Phase
Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract? A. History of the browser B. Passwords used across the system C. Events history D. Previously typed commands
Previously typed commands
Data is striped at a byte level across multiple drives, and parity information is distributed among all member drives. A. RAID Level 0 B. RAID Level 5 C. RAID Level 1 D. RAID Level 3
RAID Level 5
Which tool does the investigator use to extract artifacts left by Google Drive on the system? A. RAM Capturer B. WebBrowserPassView C. Deep Log Analyzer D. VirusTotal
RAM Capturer
Which of the following is an iOS Jailbreaking tool? A. Towelroot B. One Click Root C. Kingo Android ROOT D. Redsn0w
Redsn0w
When a file or folder is deleted, the complete path, including the original file name, is stored in a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is re-created when you ________. A. Restart Windows B. Run the antivirus tool on the system C. Run the anti-spyware tool on the system D. Kill the running processes in Windows task manager
Restart Windows
Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.? A. Man in the middle attack B. Rule-based attack C. Dictionary attack D. Brute force attack
Rule-based attack
Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization's DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry keys will Smith check to find the above information? A. MountedDevices key B. TypedURLs key C. RunMRU key D. UserAssist Key
RunMRU key
Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations? A. SOX B. HIPAA C. FISMA D. GLBA
SOX
Which among the following search warrants allows the first responder to get the victim's computer information such as service records, billing records, and subscriber information from the service provider? A. Electronic Storage Device Search Warrant B. Service Provider Search Warrant C. Citizen Informant Search Warrant D. John Doe Search Warrant
Service Provider Search Warrant
Which of the following file contains the traces of the applications installed, run, or uninstalled from a system? A. Prefetch Files B. Virtual files C. Image Files D. Shortcut Files
Shortcut Files
Raw data acquisition format creates _________ of a data set or suspect drive. A. Segmented image files B. Compressed image files C. Simple sequential flat files D. Segmented files
Simple sequential flat files
If the partition size is 4 GB, each cluster will be 32 K. Even if a file needs only 10 K, the entire 32 K will be allocated, resulting in 22 K of ________. A. Deleted space B. Cluster space C. Sector space D. Slack space
Slack space
Which of the following tool is used to locate IP addresses? A. XRY LOGICAL B. SmartWhois C. Towelroot D. Deep Log Analyzer
SmartWhois
Which of the following acts as a network intrusion detection system as well as network intrusion prevention system? A. Nikto B. Kismet C. Snort D. Accunetix
Snort
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section? A. Incident summary B. Author of the report C. Speculation or opinion as to the cause of the incident D. Purpose of the report
Speculation or opinion as to the cause of the incident
Which of the following techniques can be used to beat steganography? A. Encryption B. Decryption C. Steganalysis D. Cryptanalysis
Steganalysis
Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory? A. Swap space B. Application data C. Files and documents D. Slack space
Swap space
Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed? A. sigstore.db B. filecache.db C. Sync_config.db D. config.db
Sync_config.db
Which of the following files gives information about the client sync sessions in Google Drive on Windows? A. Sync_log.log B. Sync.log C. sync_log.log D. sync.log
Sync_log.log
Which of the following is a command line packet sniffer that runs on Linux and UNIX systems? A. WinDump B. CmosPwd C. TCPDump D. RemPass
TCPDump
Madison is on trial for allegedly breaking into her university's internal network. The police raided her dorm room and seized all of her computer equipment. Madison's lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison's lawyer trying to prove the police violated? A. The 4th Amendment B. The 1st Amendment C. The 5th Amendment D. The 10th Amendment
The 4th Amendment
In Steganalysis, which of the following describes a Known-stego attack? A. During the communication process, active attackers can change cover B. Only the steganography medium is available for analysis C. The hidden message and the corresponding stego-image are known D. Original and stego-object are available and the steganography algorithm is known
The hidden message and the corresponding stego-image are known
When marking evidence that has been collected with the "aaa/ddmmyy/nnnn/zz" format, what does the "nnnn" denote? A. The sequential number of the exhibits seized by the analyst B. The year the evidence was taken C. The sequence number for the parts of the same exhibit D. The initials of the forensics analyst
The sequential number of the exhibits seized by the analyst
A state department site was recently attacked, and all the servers had their hard disks erased. The incident response team sealed the area and commenced investigation. During evidence collection, they came across a USB flash drive that did not have the standard labeling on it. The incident team inserted the flash drive into an isolated system and found that the system disk was accidently erased. They decided to call in the FBI for further investigation. Meanwhile, they shortlisted possible suspects including three summer interns. Where did the incident team go wrong? A. Data Deduplication B. Data Extraction C. Backup D. Bit Stream Imaging
They tampered with the evidence by using it
Which of the following statements is incorrect when preserving digital evidence? A. Remove the plug from the power router or modem B. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals C. Turn on the computer and extract Windows event viewer log files D. Verify if the monitor is in on, off, or in sleep mode
Turn on the computer and extract Windows event viewer log files
Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury? A. Verbal Informal Report B. Written Informal Report C. Written Formal Report D. Verbal Formal Report
Verbal Formal Report
The process of restarting a computer that is already turned on through the operating system is called? A. Hot Boot B. Warm boot C. Cold boot D. Ice boot
Warm boot
Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use. A. Windows 8.1 B. Windows 98 C. Windows XP D. Linux
Windows 8.1
The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs A. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/ live/ap/htdocs/test B. http://victim.com/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..% c0%af../winnt/system32/cmd.exe?/c+dir+C:\Winnt\system32\Logfiles\W3SVC1 C. 127.0.0.1 - - [10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0" 200 2326 D. 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326 D. 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326
[Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/ live/ap/htdocs/test
Which of the following built-in Linux commands can be used by forensic investigators to copy data from a disk drive? A. lprm B. expr C. diff D. dd and dcfldd
dd and dcfldd
Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files? A. ff d8ff B. 50 4b 03 04 C. 25 50 44 46 D. d0 0f 11 e0
ff d8ff
Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image? A. gif B. bmp C. jpeg D. png
jpeg
Which command line tool is used to determine active network connections? A. ARP B. ps C. Isof D. netstat
netstat
Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers A. netstat - ano B. netstat - r C. netstat - b D. netstat - s
netstat - ano
Which US law does the interstate or international transportation and receiving of child pornography fall under? A. § 18 U.S.C. 252 B. §18U.S.C. 2252 C. § 18 U.S.C. 146A D. § 18 U.S.C. 1466A
§18U.S.C. 2252
