QUESTION 39
When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

QUESTION 40
Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to google.com and types in the following search.
link:www.ghttech.net What will this search produce?

QUESTION 41
Jason discovered a file named $RIYG6VR.doc in the C:$Recycle.Bin<USER SID> while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?

QUESTION 42
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it?

QUESTION 43
What must an attorney do first before you are called to testify as an expert?

QUESTION 44
What type of analysis helps to identify the time and sequence of events in an investigation?

QUESTION 45
Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for. Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report?

QUESTION 46
Which of the following should a computer forensics lab used for investigations have?

QUESTION 47
What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?

QUESTION 48
This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.

QUESTION 49
Which of the following statements is incorrect when preserving digital evidence?

QUESTION 50
Pagefile.sys is a virtual memory file used to expand the physical memory of a computer. Select the registry path for the page file:

QUESTION 51
E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

QUESTION 52
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

QUESTION 53
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

QUESTION 54
During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process.
Therefore, you report this evidence. This type of evidence is known as:

QUESTION 55
Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

QUESTION 56
What advantage does the tool Evidor have over the built-in Windows search?

QUESTION 57
What happens when a file is deleted by a Microsoft operating system using the FAT file system?

QUESTION 58
What is cold boot (hard boot)?