ECCouncil EC1-349 - ECCouncil Computer Hacking Forensic Investigator Exam
Page: 3 / 62
Total 306 questions
Question #11 (Topic: Topic 1)
A small law firm located in the Midwest has possibly been breached by a computer hacker
looking to obtain information on their clientele. The law firm does not have any on-site IT
employees, but wants to search for evidence of the breach themselves to prevent any
possible media attention. Why would this not be recommended?
looking to obtain information on their clientele. The law firm does not have any on-site IT
employees, but wants to search for evidence of the breach themselves to prevent any
possible media attention. Why would this not be recommended?
A. Searching for evidence themselves would not have any ill effects
B. Searching could possibly crash the machine or device
C. Searching creates cache files, which would hinder the investigation
D. Searching can change date/time stamps
Answer: D
Question #12 (Topic: Topic 1)
What will the following command accomplish?
dd if=/dev/xxx of=mbr.backup bs=512 count=1
dd if=/dev/xxx of=mbr.backup bs=512 count=1
A. Back up the master boot record
B. Restore the master boot record
C. Mount the master boot record on the first partition of the hard drive
D. Restore the first 512 bytes of the first partition of the hard drive
Answer: A
Question #13 (Topic: Topic 1)
A forensics investigator is searching the hard drive of a computer for files that were recently
moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line
tool but does not find anything. What is the reason for this?
moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line
tool but does not find anything. What is the reason for this?
A. He should search in C:\Windows\System32\RECYCLED folder
B. The Recycle Bin does not exist on the hard drive
C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
D. Only FAT system contains RECYCLED folder and not NTFS
Answer: C
Question #14 (Topic: Topic 1)
When using an iPod and the host computer is running Windows, what file system will be
used?
used?
A. iPod+
B. HFS
C. FAT16
D. FAT32
Answer: D
Question #15 (Topic: Topic 1)
In the following directory listing,
[ECCouncil-EC1-349-7.3/ECCouncil-EC1-349-8_2.png]
which file should be used to restore archived email messages for someone using Microsoft
Outlook?
[ECCouncil-EC1-349-7.3/ECCouncil-EC1-349-8_2.png]
which file should be used to restore archived email messages for someone using Microsoft
Outlook?
A. Outlook bak
B. Outlook ost
C. Outlook NK2
D. Outlook pst
Answer: D
