QUESTION 29
A company has identified that a hacker has modified files on one of the company’s computers. The IT department has collected the storage media from the hacked computer.
Which evidence should be obtained from the storage media to identify which files were modified?

QUESTION 30
While collecting digital evidence from a running computer involved in a cybercrime, the forensic investigator makes a list of items that need to be collected.
Which piece of digital evidence should be collected first?

QUESTION 31
Which U.S. law protects journalists from turning over their work or sources to law enforcement before the information is shared with the public?

QUESTION 32
A cybercriminal communicates with his compatriots using steganography. The FBI discovers that the criminal group uses white space to hide data in photographs.
Which tool can the cybercriminals use to facilitate this type of communication?

QUESTION 33
Which Windows component is responsible for reading the boot.ini file and displaying the boot loader menu on Windows XP during the boot process?

QUESTION 34
Which operating system creates a swap file to temporarily store information from memory on the hard drive when needed?

QUESTION 35
Which policy is included in the CAN-SPAM Act?

QUESTION 36
Which storage format is a magnetic drive?

QUESTION 37
A computer involved in a crime is infected with malware. The computer is on and connected to the company’s network. The forensic investigator arrives at the scene.
Which action should be the investigator’s first step?

QUESTION 38
Which United States law defines requirements for record keeping and destruction of electronic records for publicly traded companies?

QUESTION 39
Which technique allows a cybercriminal to hide information?

QUESTION 40
Which tool should be used with sound files, video files, and image files?

QUESTION 41
Which file system is supported by Mac?

QUESTION 42
The chief information security officer of a company believes that an attacker has infiltrated the company’s network and is using steganography to communicate with external sources. A security team is investigating the incident. They are told to start by focusing on the core elements of steganography.
What are the core elements of steganography?

QUESTION 43
How should a forensic scientist obtain the network configuration from a Windows PC before seizing it from a crime scene?

QUESTION 44
A police detective investigating a threat traces the source to a house. The couple at the house shows the detective the only computer the family owns, which is in their son’s bedroom. The couple states that their son is presently in class at a local middle school.
How should the detective legally gain access to the computer?

QUESTION 45
An organization is determined to prevent data leakage through steganography. It has developed a workflow that all outgoing data must pass through. The company will implement a tool as part of the workflow to check for hidden data.
Which tool should be used to check for the existence of steganographically hidden data?