ECCouncil Computer Hacking Forensic Investigator (V9) (312-49v9) - EC-Council Exam Questions

When examining a hard disk without a write-blocker, you should not start windows because

Windows will write data to the:

Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company’s domain controller goes down. From which system would you begin your investigation?

Which of the following techniques delete the files permanently?

What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?