Free 312-49 Questions for EC-COUNCIL Computer Hacking Forensic Investigator 312-49 Exam as PDF & Practice Test Engine

What method of copying should always be performed first before carrying out an investigation?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

You are running through a series of tests on your network to check for any security vulnerabilities.
After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

While looking through the IIS log file of a web server, you find the following entries:

What is evident from this log file?

Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\ < USER SID > \ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?

How will you categorize a cybercrime that took place within a CSP's cloud environment?

How many times can data be written to a DVD+R disk?

A master boot record (MBR) is the first sector ("sector zero") of a data storage device. What is the size of MBR?

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

Which of the following is NOT an anti-forensics technique?

Depending upon the jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?

George is a senior security analyst working for a state agency in Florida. His state ' s congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a " time-based induction machine " be used.
What IDS feature must George implement to meet this requirement?

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?