Logo ExamsQA
Exit
Official Bank 0/704

ECCouncil Computer Hacking Forensic Investigator (V9) Exam (312-49) - EC-Council Exam Questions

Last updated on June 20, 2026

97% Exam Compliance
704 Total Questions
1
Question
Which of the following files stores information about local Dropbox installation and account, email IDs linked with the account, current version/build for the local application, the host_id, and local path information?
Options
A config.db
B host.db
C sigstore.db
D filecache.db
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
As a part of the investigation, Caroline, a forensic expert, was assigned the task to examine the transaction logs pertaining to a database named Transfers. She used SQL Server Management Studio to collect the active transaction log files of the database. Caroline wants to extract detailed information on the logs, including AllocUnitId, page id, slot id, etc. Which of the following commands does she need to execute in order to extract the desired information?
Options
A DBCC LOG(Transfers, 1)
B DBCC LOG(Transfers, 0)
C DBCC LOG(Transfers, 3)
D DBCC LOG(Transfers, 2)
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Options
A MFT
B Sector
C Metadata
D Slack Space
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. he wants to recover all those data, which includes his personal photos, music, documents, videos, official email, etc. Which of the following tools shall resolve Bob’s purpose?
Options
A Cain & Abel
B Colasoft’s Capsa
C Recuva
D Xplico
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Options
A Use VMware to be able to capture the data in memory and examine it
B Create a Separate partition of several hundred megabytes and place the swap file there
C Give the Operating System a minimal amount of memory, forcing it to use a swap file
D Use intrusion forensic techniques to study memory resident infections
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.