EC0-349 Exam Questions and Answers | Exam-Dumps (Page: 7)

QUESTION: 31

You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

incremental backup copy
bit-stream copy
robust copy
full backup copy

Answer(s): B

Reveal Solution Next Question

QUESTION: 32

The offset in a hexadecimal code is:

The 0x at the beginning of the code
The first byte after the colon
The last byte after the colon
The 0x at the end of the code

Answer(s): A

Reveal Solution Next Question

QUESTION: 33

What does machine, an essential part of the coroner's toolkit do?

It is a tool specific to the MAC OS and forms a core component of the toolkit
It traverses the file system and produces a listing of all files based on the modification, access and change timestamps
The tools scans for i-node information, which is used by other tools in the tool kit
It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

Answer(s): B

Reveal Solution Next Question

QUESTION: 34

When examining a file with a Hex Editor, what space does the file header occupy?

the first several bytes of the file
the last several bytes of the file
none, file headers are contained in the FAT
one byte at the beginning of the file

Answer(s): A

Reveal Solution Next Question

QUESTION: 35

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

chain of custody
law of probability
rules of evidence
policy of separation

Answer(s): A

Reveal Solution Next Question

EC-Council EC0-349 Exam (page: 7) EC-Council EC0-349 ECCouncil Computer Hacking Forensic Investigator Updated on: 25-Dec-2025

QUESTION: 31

QUESTION: 32

QUESTION: 33

QUESTION: 34

QUESTION: 35

EC-Council EC0-349 Exam (page: 7)
EC-Council EC0-349 ECCouncil Computer Hacking Forensic Investigator
Updated on: 25-Dec-2025