While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?
A. Keep the information of file for later review
B. Destroy the evidence
C. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
D. Present the evidence to the defense attorney
What are the security risks of running a "repair" installation for Windows XP?
A. Pressing Shift+F10gives the user administrative rights
B. Pressing Shift+F1gives the user administrative rights
C. Pressing Ctrl+F10 gives the user administrative rights
D. There are no security risks when running the "repair" installation for Windows XP
Where does Encase search to recover NTFS files and folders?
A. MBR
B. MFT
C. Slack space
D. HAL
During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?
A. C:\Program Files\Exchsrvr\servername.log
B. D:\Exchsrvr\Message Tracking\servername.log
C. C:\Exchsrvr\Message Tracking\servername.log
D. C:\Program Files\Microsoft Exchange\srvr\servername.log
When reviewing web logs, you see an entry for resource not found in the HTTP status code field. What is the actual error code that you would see in the log for resource not found?
A. 202
B. 404
C. 606
D. 999
Which US law does the interstate or international transportation and receiving of child pornography fall under?
A. - 8. U.S.C. 1466A
B. - 8. U.S.C 252
C. - 8. U.S.C 146A
D. - 8. U.S.C 2252
Which of the following techniques can be used to beat steganography?
A. Encryption
B. Steganalysis
C. Decryption
D. Cryptanalysis
Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?
A. Swap space
B. Application data
C. Files and documents
D. Slack space
Which list contains the most recent actions performed by a Windows User?
A. MRU
B. Activity
C. Recents
D. Windows Error Log
What is the capacity of Recycle bin in a system running on Windows Vista?
A. 2.99GB
B. 3.99GB
C. Unlimited
D. 10% of the partition space