ECCouncil 312-49v9 - ECCouncil Computer Hacking Forensic Investigator (V9) Exam
Page: 2 / 98
Total 486 questions
Question #6 (Topic: Topic 1)
In which step of the computer forensics investigation methodology would you run MD5
checksum on the evidence?
checksum on the evidence?
A. Obtain search warrant
B. Evaluate and secure the scene
C. Collect the evidence
D. Acquire the data
Answer: D
Question #7 (Topic: Topic 1)
Damaged portions of a disk on which no read/Write operation can be performed is known
as ______________.
as ______________.
A. Lost sector
B. Bad sector
C. Empty sector
D. Unused sector
Answer: B
Question #8 (Topic: Topic 1)
SIM is a removable component that contains essential information about the subscriber. It
has both volatile and non-volatile memory. The file system of a SIM resides in
_____________ memory.
has both volatile and non-volatile memory. The file system of a SIM resides in
_____________ memory.
A. Volatile
B. Non-volatile
Answer: B
Question #9 (Topic: Topic 1)
During first responder procedure you should follow all laws while collecting the evidence,
and contact a computer forensic examiner as soon as possible
and contact a computer forensic examiner as soon as possible
A. True
B. False
Answer: A
Question #10 (Topic: Topic 1)
Which of the following is not a part of disk imaging tool requirements?
A. The tool should not change the original content
B. The tool should log I/O errors in an accessible and readable form, including the type and location of the error
C. The tool must have the ability to be held up to scientific and peer review
D. The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source
Answer: D
