With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

• A.0
• B.10
• C.100
• D.1

Comment: *

Name: *

Email: *

Verification: *

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

• A.date and time the message was sent
• B.unique message identifier
• C.contents of the e-mail message
• D.user account that was used to send the account
• E.attachments sent with the e-mail message

Comment: *

Name: *

Email: *

Verification: *

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

• A.The nature of the attack
• B.The manufacturer of the system compromised
• C.The logic, formatting and elegance of the code used in the attack
• D.The vulnerability exploited in the incident

Comment: *

Name: *

Email: *

Verification: *

Which of the following tools will allow a forensic Investigator to acquire the memory dump of a suspect machine so that It may be Investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?

• A.Hex Editor
• B.DB Browser SQLite
• C.Bulk Extractor
• D.Belkasoft Live RAM Capturer and AccessData FTK imager

Comment: *

Name: *

Email: *

Verification: *

What file structure database would you expect to find on floppy disks?

• A.FAT16
• B.FAT12
• C.FAT32
• D.NTFS

Comment: *

Name: *

Email: *

Verification: *