Multiple Choice
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?
A) A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
B) Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
C) A simple DOS copy will not include deleted files, file slack and other information
D) There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
Correct Answer:
Verified
Correct Answer:
Verified
Q151: An Expert witness give an opinion if:<br>A)
Q152: At what level of governance are individual
Q153: The Annualized Loss Expectancy (Before) minus Annualized
Q154: Your incident response plan should include which
Q155: What header field in the TCP/IP protocol
Q157: Risk that remains after risk mitigation is
Q158: You are running through a series of
Q159: You are assisting in the investigation of
Q160: Which of the following reports should you
Q161: You work as a project manager for