Free ECCouncil 312-49v9 Practice Exam with Questions & Answers | Set: 8

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?

dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

Which of the following techniques can be used to beat steganography?

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

Which of the following tools will help the investigator to analyze web server logs?

Which MySQL log file contains information on server start and stop?

What stage of the incident handling process involves reporting events?

Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?

22,164 cylinders/disk

80 heads/cylinder

63 sectors/track

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card. What can Jason do in this scenario to reset the PIN and access SIM data?

Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?

Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his claim?

Which command can provide the investigators with details of all the loaded modules on a Linux-based system?