ECCouncil Computer Hacking Forensic Investigator(CHFI) (V9) v11.0 (312-49v9)
Data files from original evidence should be used for forensics analysis A. True B. False
Answer : B
When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on A. True B. False
Answer : B
A computer forensic report is a report which provides detailed information on the complete forensics investigation process. A. True B. False
Answer : A
According to US federal rules, to present a testimony in a court of law, an expert witness needs to furnish certain information to prove his eligibility. Jason, a qualified computer forensic expert who has started practicing two years back, was denied an expert testimony in a computer crime case by the US Court of Appeals for the Fourth Circuit in Richmond, Virginia. Considering the US federal rules, what could be the most appropriate reason for the court to reject Jason's eligibility as an expert witness? A. Jason was unable to furnish documents showing four years of previous experience in the field B. Being a computer forensic expert, Jason is not eligible to present testimony in a computer crime case C. Jason was unable to furnish documents to prove that he is a computer forensic expert D. Jason was not aware of legal issues involved with computer crimes
Answer : A
All the Information about the user activity on the network, like details about login and logoff attempts, is collected in the security log of the computer. When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table. In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer? A. 528 B. 529 C. 530 D. 531
Answer : A
An expert witness is a witness, who by virtue of education, profession, or experience, is believed to have special knowledge of his/her subject beyond that of the average person, sufficient that others legally depend upon his/her opinion. A. True B. False
Answer : A
Attackers can manipulate variables that reference files with "dot-dot-slash (./)" sequences and their variations such as http://www.juggyDoy.corn/GET/process.php./././././././././etc/passwd. Identify the attack referred. A. Directory traversal B. SQL Injection C. XSS attack D. File injection
Answer : A
Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity. A. True B. False
Answer : A
Dumpster Diving refers to: A. Searching for sensitive information in the user's trash bins and printer trash bins, and searching the user's desk for sticky notes B. Looking at either the user's keyboard or screen while he/she is logging in C. Convincing people to reveal the confidential information D. Creating a set of dictionary words and names, and trying all the possible combinations to crack the password
Answer : A
During first responder procedure you should follow all laws while collecting the evidence, and contact a computer forensic examiner as soon as possible A. True B. False
Answer : A
Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives? A. It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers B. Local archives do not have evidentiary value as the email client may alter the message data C. Local archives should be stored together with the server storage archives in order to be admissible in a court of law D. Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server
Answer : A
Email archiving is a systematic approach to save and protect the data contained in emails so that it can tie easily accessed at a later date. A. True B. False
Answer : A
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where, X represents the _________. A. Drive name B. Sequential number C. Original file name's extension D. Original file name
Answer : A
Graphics Interchange Format (GIF) is a ___________RGB bitmap Image format for images with up to 256 distinct colors per frame. A. 8-bit B. 16-bit C. 24-bit D. 32-bit
Answer : A
How do you define Technical Steganography? A. Steganography that uses physical or chemical means to hide the existence of a message B. Steganography that utilizes written natural language to hide the message in the carrier in some non-obvious ways C. Steganography that utilizes written JAVA language to hide the message in the carrier in some non-obvious ways D. Steganography that utilizes visual symbols or signs to hide secret messages
Answer : A
How do you define forensic computing? A. It is the science of capturing, processing, and investigating data security incidents and making it acceptable to a court of law. B. It is a methodology of guidelines that deals with the process of cyber investigation C. It Is a preliminary and mandatory course necessary to pursue and understand fundamental principles of ethical hacking D. It is the administrative and legal proceeding in the process of forensic investigation
Answer : A
In Windows 7 system files, which file reads the Boot.ini file and loads Ntoskrnl.exe, Bootvid.dll, Hal.dll, and boot-start device drivers? A. Ntldr B. Gdi32.dll C. Kernel32.dll D. Boot.in
Answer : A
In an echo data hiding technique, the secret message is embedded into a __________as an echo. A. Cover audio signal B. Phase spectrum of a digital signal C. Pseudo-random signal D. Pseudo- spectrum signal
Answer : A
Injection flaws are web application vulnerabilities that allow untrusted data to be Interpreted and executed as part of a command or query. Attackers exploit injection flaws by constructing malicious commands or queries that result in data loss or corruption, lack of accountability, or denial of access. Which of the following injection flaws involves the injection of malicious code through a web application? A. SQL Injection B. Password brute force C. Nmap Scanning D. Footprinting
Answer : A
Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack Jason can infer from his findings? A. DNS Poisoning B. Cookie Poisoning Attack C. DNS Redirection D. Session poisoning
Answer : A
LBA (Logical Block Address) addresses data by allotting a ___________to each sector of the hard disk. A. Sequential number B. Index number C. Operating system number D. Sector number
Answer : A
Mobile phone forensics is the science of recovering digital evidence from a mobile phone under forensically sound conditions. A. True B. False
Answer : A
Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident. A. True B. False
Answer : A
Networks are vulnerable to an attack which occurs due to overextension of bandwidth, bottlenecks, network data interception, etc. Which of the following network attacks refers to a process in which an attacker changes his or her IP address so that he or she appears to be someone else? A. IP address spoofing B. Man-in-the-middle attack C. Denial of Service attack D. Session sniffing
Answer : A
Physical security recommendations: There should be only one entrance to a forensics lab A. True B. False
Answer : A
Raw data acquisition format creates ____________of a data set or suspect drive. A. Simple sequential flat files B. Segmented files C. Compressed image files D. Segmented image files
Answer : A
Router log files provide detailed Information about the network traffic on the Internet. It gives information about the attacks to and from the networks. The router stores log files in the____________. A. Router cache B. Application logs C. IDS logs D. Audit logs
Answer : A
Syslog is a client/server protocol standard for forwarding log messages across an IP network. Syslog uses ___________to transfer log messages in a clear text format. A. TCP B. FTP C. SMTP D. POP
Answer : A
System software password cracking is defined as cracking the operating system and all other utilities that enable a computer to function. A. True B. False
Answer : A
The ARP table of a router comes in handy for Investigating network attacks, as the table contains IP addresses associated with the respective MAC addresses. The ARP table can be accessed using the __________command in Windows 7. A. C:\arp -a B. C:\arp -d C. C:\arp -s D. C:\arp -b
Answer : A
The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin? A. INFO2 file B. INFO1 file C. LOGINFO2 file D. LOGINFO1 file
Answer : A
The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin. What is the size limit for Recycle Bin in Vista and later versions of the Windows? A. No size limit B. Maximum of 3.99 GB C. Maximum of 4.99 GB D. Maximum of 5.99 GB
Answer : A
The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used. Which command displays the network configuration of the NICs on the system? A. ipconfig /all B. netstat C. net session D. tasklist
Answer : A
Under no circumstances should anyone, with the exception of qualified computer forensics personnel, make any attempts to restore or recover information from a computer system or device that holds electronic information. A. True B. False
Answer : A
What is a SCSI (Small Computer System Interface)? A. A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners B. A standard electronic interface used between a computer motherboard's data paths or bus and the computer's disk storage devices C. A "plug-and-play" interface, which allows a device to be added without an adapter card and without rebooting the computer D. A point-to-point serial bi-directional interface for transmitting data between computer devices at data rates of up to 4 Gbps
Answer : A
What is a bit-stream copy? A. Bit-Stream Copy is a bit-by-bit copy of the original storage medium and exact copy of the original disk B. A bit-stream image is the file that contains the NTFS files and folders of all the data on a disk or partition C. A bit-stream image is the file that contains the FAT32 files and folders of all the data on a disk or partition D. Creating a bit-stream image transfers only non-deleted files from the original disk to the image disk
Answer : A
What is a first sector ("sector zero") of a hard disk? A. Master boot record B. System boot record C. Secondary boot record D. Hard disk boot record
Answer : A
What is the "Best Evidence Rule"? A. It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy B. It contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, and command history C. It contains hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, hidden partitions, registry settings, and event logs D. It contains information such as open network connection, user logout, programs that reside in memory, and cache data
Answer : A
What is the First Step required in preparing a computer for forensics investigation? A. Do not turn the computer off or on, run any programs, or attempt to access data on a computer B. Secure any relevant media C. Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue D. Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination
Answer : A
What is the first step that needs to be carried out to crack the password? A. A word list is created using a dictionary generator program or dictionaries B. The list of dictionary words is hashed or encrypted C. The hashed wordlist is compared against the target hashed password, generally one word at a time D. If it matches, that password has been cracked and the password cracker displays the unencrypted version of the password
Answer : A
What is the smallest allocation unit of a hard disk? A. Cluster B. Spinning tracks C. Disk platters D. Slack space
Answer : A
When a system is compromised, attackers often try to disable auditing, in Windows 7; modifications to the audit policy are recorded as entries of Event ID____________. A. 4902 B. 3902 C. 4904 D. 3904
Answer : A
When collecting electronic evidence at the crime scene, the collection should proceed from the most volatile to the least volatile A. True B. False
Answer : A
When collecting evidence from the RAM, where do you look for data? A. Swap file B. SAM file C. Data file D. Log file
Answer : A
Which Is a Linux journaling file system? A. Ext3 B. HFS C. FAT D. BFS
Answer : A
Which device in a wireless local area network (WLAN) determines the next network point to which a packet should be forwarded toward its destination? A. Wireless router B. Wireless modem C. Antenna D. Mobile station
Answer : A
Which of the following attacks allows attacker to acquire access to the communication channels between the victim and server to extract the information? A. Man-in-the-middle (MITM) attack B. Replay attack C. Rainbow attack D. Distributed network attack
Answer : A
Which of the following commands shows you the NetBIOS name table each? A. nbtstat -n B. nbtstat -c C. nbtstat -r D. nbtstat -s
Answer : A
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)? A. Errors-To header B. Content-Transfer-Encoding header C. Mime-Version header D. Content-Type header
Answer : A
Which of the following file in Novel GroupWise stores information about user accounts? A. ngwguard.db B. gwcheck.db C. PRIV.EDB D. PRIV.STM
Answer : A
Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader? A. Open code steganography B. Visual semagrams steganography C. Text semagrams steganography D. Technical steganography
Answer : A
Which table is used to convert huge word lists (i .e. dictionary files and brute-force lists) into password hashes? A. Rainbow tables B. Hash tables C. Master file tables D. Database tables
Answer : A
Which wireless standard has bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz? A. 802.11a B. 802.11b C. 802.11g D. 802.11i
Answer : A
Who is responsible for the following tasks? -> Secure the scene and ensure that it is maintained In a secure state until the Forensic Team advises. -> Make notes about the scene that will eventually be handed over to the Forensic Team. A. Non-Laboratory Staff B. System administrators C. Local managers or other non-forensic staff D. Lawyers
Answer : A
Why is it Important to consider health and safety factors in the work carried out at all stages of the forensic process conducted by the forensic analysts? A. This is to protect the staff and preserve any fingerprints that may need to be recovered at a later date B. All forensic teams should wear protective latex gloves which makes them look professional and cool C. Local law enforcement agencies compel them to wear latest gloves D. It is a part of ANSI 346 forensics standard
Answer : A
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at: A. C:\windows\system32\config\SAM B. C:\windows\system32\con\SAM C. C:\windows\system32\Boot\SAM D. C:\windows\system32\drivers\SAM
Answer : A
Network forensics allows Investigators to inspect network traffic and logs to identify and locate the attack system. Network forensics can reveal: (Select three answers) A. Source of security incidents and network attacks B. Path of the attack C. Intrusion techniques used by attackers D. Hardware configuration of the attacker's system
Answer : A,B,C
An intrusion detection system (IDS) gathers and analyzes information from within a computer or a network to identify any possible violations of security policy, including unauthorized access, as well as misuse. Which of the following intrusion detection systems audit events that occur on a specific host? A. Network-based intrusion detection B. Host-based intrusion detection C. Log file monitoring D. File integrity checking
Answer : B
Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges. Which of the following vulnerability/exploitation is referred above? A. Session ID in URLs B. Timeout Exploitation C. I/O exploitation D. Password Exploitation
Answer : B
BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap? A. Header B. The RGBQUAD array C. Information header D. Image data
Answer : B
Billy, a computer forensics expert, has recovered a large number of DBX files during forensic investigation of a laptop. Which of the following email clients he can use to analyze the DBX files? A. Microsoft Outlook B. Microsoft Outlook Express C. Mozilla Thunderoird D. Eudora
Answer : B
Cyber-crime is defined as any Illegal act involving a gun, ammunition, or its applications. A. True B. False
Answer : B
Damaged portions of a disk on which no read/Write operation can be performed is known as ______________. A. Lost sector B. Bad sector C. Empty sector D. Unused sector
Answer : B
Depending upon the Jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers? A. 18 USC 7029 B. 18 USC 7030 C. 18 USC 7361 D. 18 USC 7371
Answer : B
Deposition enables opposing counsel to preview an expert witness's testimony at trial. Which of the following deposition is not a standard practice? A. Both attorneys are present B. Only one attorneys is present C. No jury or judge D. Opposing counsel asks questions
Answer : B
Digital evidence is not fragile in nature. A. True B. False
Answer : B
Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file. Which of the following hash algorithms produces a message digest that is 128 bits long? A. CRC-32 B. MD5 C. SHA-1 D. SHA-512
Answer : B
During the seizure of digital evidence, the suspect can be allowed touch the computer system. A. True B. False
Answer : B
Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time. Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network? A. Same-platform correlation B. Cross-platform correlation C. Multiple-platform correlation D. Network-platform correlation
Answer : B
File deletion is a way of removing a file from a computer's file system. What happens when a file is deleted in windows7? A. The last letter of a file name is replaced by a hex byte code E5h B. The operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted C. Corresponding clusters in FAT are marked as used D. The computer looks at the clusters occupied by that file and does not avails space to store a new file
Answer : B
File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file A. First 10 bytes B. First 20 bytes C. First 30 bytes D. First 40 bytes
Answer : B
JPEG is a commonly used method of compressing photographic Images. It uses a compression algorithm to minimize the size of the natural image, without affecting the quality of the image. The JPEG lossy algorithm divides the image in separate blocks of____________. A. 4x4 pixels B. 8x8 pixels C. 16x16 pixels D. 32x32 pixels
Answer : B
P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails. A. Port 109 B. Port 110 C. Port 115 D. Port 123
Answer : B
SIM is a removable component that contains essential information about the subscriber. It has both volatile and non-volatile memory. The file system of a SIM resides in _____________ memory. A. Volatile B. Non-volatile
Answer : B
When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code. A. First 12 B. First 16 C. First 22 D. First 24
Answer : B
Which of the following reports are delivered under oath to a board of directors/managers/panel of jury? A. Written informal Report B. Verbal Formal Report C. Written Formal Report D. Verbal Informal Report
Answer : B
You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at which sessions the machine has opened with other systems? A. Net sessions B. Net use C. Net config D. Net share
Answer : B
Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software? A. Operating System (OS) logs B. Application logs C. Security software logs D. Audit logs
Answer : C
Ever-changing advancement or mobile devices increases the complexity of mobile device examinations. Which or the following is an appropriate action for the mobile forensic investigation? A. To avoid unwanted interaction with devices found on the scene, turn on any wireless interfaces such as Bluetooth and Wi-Fi radios B. Do not wear gloves while handling cell phone evidence to maintain integrity of physical evidence C. If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons D. If the phone is in a cradle or connected to a PC with a cable, then unplug the device from the computer
Answer : C
Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information? A. UserAssist Key B. MountedDevices key C. RunMRU key D. TypedURLs key
Answer : C
The Electronic Serial Number (ESN) is a unique __________ recorded on a secure chip in a mobile phone by the manufacturer. A. 16-bit identifier B. 24-bit identifier C. 32-bit identifier D. 64-bit identifier
Answer : C
The evolution of web services and their increasing use in business offers new attack vectors in an application framework. Web services are based on XML protocols such as web Services Definition Language (WSDL) for describing the connection points, Universal Description, Discovery, and Integration (UDDI) for the description and discovery of Web services and Simple Object Access Protocol (SOAP) for communication between Web services that are vulnerable to various web application threats. Which of the following layer in web services stack is vulnerable to fault code leaks? A. Presentation Layer B. Security Layer C. Discovery Layer D. Access Layer
Answer : C
Which of the following Steganography techniques allows you to encode information that ensures creation of cover for secret communication? A. Substitution techniques B. Transform domain techniques C. Cover generation techniques D. Spread spectrum techniques
Answer : C
Which of the following Wi-Fi chalking methods refers to drawing symbols in public places to advertise open Wi-Fi networks? A. WarWalking B. WarFlying C. WarChalking D. WarDhving
Answer : C
Which of the following is not a part of data acquisition forensics Investigation? A. Permit only authorized personnel to access B. Protect the evidence from extremes in temperature C. Work on the original storage medium not on the duplicated copy D. Disable all remote access to the system
Answer : C
Which of the following standard is based on a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases? A. Daubert Standard B. Schneiderman Standard C. Frye Standard D. FERPA standard
Answer : C
Which of the following would you consider an aspect of organizational security, especially focusing on IT security? A. Biometric information security B. Security from frauds C. Application security D. Information copyright security
Answer : C
An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers. Which of the following statement is true for NTP Stratum Levels? A. Stratum-0 servers are used on the network; they are not directly connected to computers which then operate as stratum-1 servers B. Stratum-1 time server is linked over a network path to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions C. A stratum-2 server is directly linked (not over a network path) to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on
Answer : D
First responder is a person who arrives first at the crime scene and accesses the victim's computer system after the incident. He or She is responsible for protecting, integrating, and preserving the evidence obtained from the crime scene. Which of the following is not a role of first responder? A. Identify and analyze the crime scene B. Protect and secure the crime scene C. Package and transport the electronic evidence to forensics lab D. Prosecute the suspect in court of law
Answer : D
In which step of the computer forensics investigation methodology would you run MD5 checksum on the evidence? A. Obtain search warrant B. Evaluate and secure the scene C. Collect the evidence D. Acquire the data
Answer : D
Smith, as a part his forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What Jason can do in this scenario to reset the PIN and access SIM data? A. He should contact the device manufacturer for a Temporary Unlock Code (TUK) to gain access to the SIM B. He cannot access the SIM data in this scenario as the network operators or device manufacturers have no idea about a device PIN C. He should again attempt PIN guesses after a time of 24 hours D. He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM
Answer : D
Task list command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following task list commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process? A. tasklist/s B. tasklist/u C. tasklist/p D. tasklist/V
Answer : D
The need for computer forensics is highlighted by an exponential increase in the number of cybercrimes and litigations where large organizations were involved. Computer forensics plays an important role in tracking the cyber criminals. The main role of computer forensics is to: A. Maximize the investigative potential by maximizing the costs B. Harden organization perimeter security C. Document monitoring processes of employees of the organization D. Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court
Answer : D
Which of the following is not a part of disk imaging tool requirements? A. The tool should not change the original content B. The tool should log I/O errors in an accessible and readable form, including the type and location of the error C. The tool must have the ability to be held up to scientific and peer review D. The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source
Answer : D
Which of the following is not a part of the technical specification of the laboratory-based imaging system? A. High performance workstation PC B. Remote preview and imaging pod C. Anti-repudiation techniques D. very low image capture rate
Answer : D
Which of the following is not correct when documenting an electronic crime scene? A. Document the physical scene, such as the position of the mouse and the location of components near the system B. Document related electronic components that are difficult to find C. Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer D. Write down the color of shirt and pant the suspect was wearing
Answer : D
Which of the following statement is not correct when dealing with a powered-on computer at the crime scene? A. If a computer is switched on and the screen is viewable, record the programs running on screen and photograph the screen B. If a computer is on and the monitor shows some picture or screen saver, move the mouse slowly without depressing any mouse button and take a photograph of the screen and record the information displayed C. If a monitor is powered on and the display is blank, move the mouse slowly without depressing any mouse button and take a photograph D. If the computer is switched off. power on the computer to take screenshot of the desktop
Answer : D
Which of the following statements is incorrect when preserving digital evidence? A. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals B. Verily if the monitor is in on, off, or in sleep mode C. Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode D. Turn on the computer and extract Windows event viewer log files
Answer : D
Which of the following statements is not a part of securing and evaluating electronic crime scene checklist? A. Locate and help the victim B. Transmit additional flash messages to other responding units C. Request additional help at the scene if needed D. Blog about the incident on the internet
Answer : D
Which one of the following is not a consideration in a forensic readiness planning checklist? A. Define the business states that need digital evidence B. Identify the potential evidence available C. Decide the procedure for securely collecting the evidence that meets the requirement fn a forensically sound manner D. Take permission from all employees of the organization
Answer : D