ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam
Go to Exam

Exam 312-49v10 topic 1 question 772 discussion

Actual exam question from ECCouncil's 312-49v10
Question #: 772
Topic #: 1
[All 312-49v10 Questions]

An investigator is tasked with analyzing metadata from a suspected MAC system in a case of data theft. They have decided to parse the Spotlight database file, store.db. Which of the following tools and steps would be most effective for obtaining recently accessed file details from this MacOS system?

  • A. Running the spotlight_parser Python script on the store.db file to extract file metadata
  • B. Using the OS X Auditor to hash artifacts on the running system
  • C. Implementing the Stellar Data Recovery Professional for Mac to recover lost or deleted data
  • D. Utilizing Memoryze for the Mac to analyze the memory images of the Mac machine
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by Elb at May 29, 2024, 1:36 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Elb
3 months, 1 week ago
Selected Answer: A
In digital forensic examination, the database information parsed from Spotlight retrieves details such as dates, last opened, and number of times an application or file is opened. Syntax: python spotlight_parser.py <path_to_database> <path_to_output_folder>
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago