How to Easily Pass the ECCouncil 312-49v9 Exam: Expert Advice

Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

How many possible sequence number combinations are there in TCP/IP protocol?

What does the part of the log, “% SEC-6-IPACCESSLOGP”, extracted from a Cisco router represent?

Which of the following tool enables data acquisition and duplication?

Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?

Depending upon the jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?

An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

The process of restarting a computer that is already turned on through the operating system is called?

The investigator wants to examine changes made to the system’s registry by the suspect program. Which of the following tool can help the investigator?

A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content. Which of the following files is he going to examine?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups?

Which of the following files DOES NOT use Object Linking and Embedding (OLE) technology to embed and link to other objects?

Why should you never power on a computer that you need to acquire digital evidence from?