Exam 312-49v10 topic 1 question 68 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 68
Topic #: 1

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

A. The registry
B. The swap file
C. The recycle bin
D. The metadata

Show Suggested Answer

Suggested Answer: B 🗳️

by Laverio at March 7, 2024, 11:06 a.m.

Comments

Submit Cancel

044f354

1 month, 1 week ago

Selected Answer: B

Answer: B Explanation: (A) The registry ❌ Unlikely to contain direct evidence of unsaved cheque printing (B) The swap file ✅ May contain remnants of unsaved or deleted data from memory (C) The recycle bin ❌ Would only contain intentionally deleted files, not unsaved data (D) The metadata ❌ Not specific enough; wouldn't contain actual cheque data The swap file (also known as pagefile or virtual memory) is the best next step in this investigation. It temporarily stores data from RAM when physical memory is full, potentially including traces of unsaved documents or recently closed applications. In a financial fraud case where no saved files were found, examining the swap file could reveal fragments of the unauthorized cheques that were printed but not saved to disk.

upvoted 1 times

...

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam

Exam 312-49v10 topic 1 question 68 discussion

Comments

044f354

SY0-701