Exam 312-49v10 topic 1 question 776 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 776
Topic #: 1

In a recent cybercrime investigation, a forensic analyst found that the suspect had used anti-forensic techniques to complicate the investigation process. The criminal had been working to erase data, manipulate metadata, and employ encryption, which made the investigation significantly more complex. Which of the following scenarios would indicate that the suspect had overwritten data and metadata in an attempt to evade investigation?

A. The investigator detects that the suspect used VeraCrypt for full-volume encryption to protect critical files
B. AnalyzeMFT tool reveals inconsistencies between $STANDARD_INFORMATION and $FILE_NAME attributes in the NTFS file system
C. The investigator finds the disk has been completely formatted, wiping its address tables and unlinking all files in the file system
D. The investigator finds the majority of the hard drive's sectors contain the null character, indicating usage of disk wiping utilities

Show Suggested Answer

Suggested Answer: D 🗳️

by Elb at June 12, 2024, 3:20 a.m.

Comments

Submit Cancel

Elb

5 months, 2 weeks ago

Selected Answer: D

Disk wiping involves erasing data from the disk by deleting its links to memory blocks and overwriting the memory contents In this process, the application overwrites the contents of MBR, partition table and other sectors of the hard drive with characters such as null character or any random character several times (using data wiping standards). In this case, the forensic investigator finds it difficult to recover data from the storage device.

upvoted 1 times

...

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam

Exam 312-49v10 topic 1 question 776 discussion

Comments

Elb

Get IT Certification

New Version GCP Professional Cloud Architect Certificate & Helpful Information

The 5 Most In-Demand Project Management Certifications of 2019