Which of the following is not correct when documenting an electronic crime scene?

• A.Document related electronic components that are difficult to find
• B.Write down the color of shirt and pant the suspect was wearing
• C.Document the physical scene, such as the position of the mouse and the location of components near the system
• D.Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer

Comment: *

Name: *

Email: *

Verification: *

How many possible sequence number combinations are there in TCP/IP protocol?

• A.320 billion
• B.32 million
• C.1 billion
• D.4 billion

Comment: *

Name: *

Email: *

Verification: *

The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term?

• A.Hearsay
• B.Spoliation
• C.Detection
• D.Discovery

Comment: *

Name: *

Email: *

Verification: *

On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

• A.Password.conf
• B.AMS
• C.Shadow file
• D.SAM

Comment: *

Name: *

Email: *

Verification: *

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

• A.The Recycle Bin does not exist on the hard drive
• B.Only FAT system contains RECYCLED folder and not NTFS
• C.The files are hidden and he must use switch to view themThe files are hidden and he must use ?
  switch to view them
• D.He should search in C:\Windows\System32\RECYCLED folder

Comment: *

Name: *

Email: *

Verification: *