NO.304 Which of the following commands shows you the username and IP address used to access the system via a remote login session and the Type of client from which they are accessing the system?

NO.305 Item 2If you come across a sheepdip machine at your client site, what would you infer?

NO.306 In which registry does the system store the Microsoft security IDs?

NO.307 What happens when a file is deleted by a Microsoft operating system using the FAT file system?

NO.308 Lynne receives the following email:
Dear [email protected]! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24 You have 24 hours to fix this problem or risk to be closed permanently!
To proceed Please Connect >> My Apple ID
Thank You The link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/ What type of attack is this?

NO.309 Windows identifies which application to open a file with by examining which of the following?

NO.310 Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer’s log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies’ domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords.
What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?

NO.311 Diskcopy is:

NO.312 NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

NO.313 Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company’s domain controller goes down. From which system would you begin your investigation?

NO.314 While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

NO.315 What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

NO.316 The Electronic Serial Number (ESN) is a unique __________ recorded on a secure chip in a mobile phone by the manufacturer.

NO.317 Lynne receives the following email:
Dear [email protected]!
We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11 /1 O 20:40:24 You have 24 hours to fix this problem or risk to be closed permanently!
To proceed Please Connect>> My Apple ID
Thank You
The
link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/
What type of attack is this?

NO.318 Which of the following filesystem is used by Mac OS X?

NO.319 What does Locard’s Exchange Principle state?

NO.320 You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

NO.321 A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

NO.322 Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

NO.323 Which of the following statements is not a part of securing and evaluating electronic crime scene checklist?

NO.324 Charles has accidentally deleted an important file while working on his Mac computer. He wants to recover the deleted file as it contains some of his crucial business secrets. Which of the following tool will help Charles?

NO.325 In Windows Security Event Log, what does an event id of 530 imply?

NO.326 Which is not a part of environmental conditions of a forensics lab?

NO.327 Which of the following is a list of recently used programs or opened files?

NO.328 FAT32 is a 32-bit version of FAT file system using smaller clusters and results in efficient storage capacity. What is the maximum drive size supported?