Question 1

Which of the following attacks refers to unintentional download of malicious software via the
Internet? Here, an attacker exploits flaws in browser software to install malware merely by the user
visiting the malicious website.

Accepted Answer

C

Explanation: A drive-by download is an attack where malicious code is downloaded and executed on a user's computer without their consent or knowledge. This occurs simply by visiting a compromised or malicious website. The attack vector relies on exploiting vulnerabilities in the web browser, associated plugins (like Flash or Java), or the underlying operating system. The user's only action is navigating to a URL; no further interaction, such as clicking a link or authorizing a download, is required. This method directly matches the scenario described in the question.

Question 2

Which of the following tool enables a user to reset his/her lost admin password in a Windows system?

Accepted Answer

B

Explanation: Active@ Password Changer is a specialized software utility designed specifically for resetting lost or forgotten passwords for local user accounts on Windows systems, including the administrator account. It operates by creating a bootable USB drive or CD/DVD that allows the user to start the system in a pre-boot environment. From there, it can directly access and modify the Security Account Manager (SAM) database file, where password hashes are stored, to clear an existing password or set a new one without needing to know the original.

Question 3

Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows
computer. He has no cloud storage or backup hard drives. he wants to recover all those data, which
includes his personal photos, music, documents, videos, official email, etc. Which of the following
tools shall resolve Bob’s purpose?

Accepted Answer

B

Explanation: The core issue is the recovery of lost files from a local Windows hard drive after a system crash. Recuva is a specialized data recovery tool designed specifically for this purpose. It scans storage media (like hard drives) for files that have been deleted or lost due to corruption, formatting, or system crashes and attempts to restore them. It is the only tool listed that directly addresses the user's need for file system data recovery.

Question 4

Which component in the hard disk moves over the platter to read and write information?

Accepted Answer

D

Explanation: The read/write head is the component at the tip of the actuator arm that performs the physical reading and writing of data. It is a tiny transducer that flies nanometers above the surface of the spinning platter. The head magnetizes small areas of the platter to write data and detects the existing magnetic orientation to read data. The actuator arm moves the head across the platter's radius to position it over the correct data track, but the head is the specific component that interacts with the platter's magnetic surface to handle information.

Question 5

What file structure database would you expect to find on floppy disks?

Accepted Answer

D

Explanation: The File Allocation Table 12 (FAT12) is the file system standardly used for floppy disks. It was designed by Microsoft specifically for low-capacity media. Its 12-bit entries for addressing clusters are efficient and sufficient for the small storage size of a typical 1.44 MB floppy disk, which has a cluster count well below the FAT12 limit (fewer than 4085 clusters). The minimal overhead of FAT12 makes it the only practical choice among the options for this type of legacy media.

Question 6

The offset in a hexadecimal code is:

Accepted Answer

B

Explanation: In computer science and digital forensics, an offset is an address that represents a specific location within a file or memory, typically measured from a starting point. These offsets are almost universally represented using hexadecimal numbering for convenience. In many programming languages (like C/C++), command-line tools, and debuggers, the prefix "0x" is the standard notation to explicitly identify a number as hexadecimal. While the offset is technically the numerical value that follows the prefix, the "0x" is the standard indicator for the hexadecimal code used to represent that offset. Among the choices, this is the only option related to the notation of the offset value itself.

Question 7

To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

Accepted Answer

C

Explanation: The Pre-investigation Phase encompasses all preparatory and foundational activities conducted before a specific digital investigation is initiated. This phase focuses on building the capability to perform forensic work effectively. Key activities include setting up a dedicated forensics laboratory, which involves strategic planning, securing a budget, acquiring necessary hardware and software tools, and establishing policies and procedures. These steps are prerequisites for conducting any sound forensic examination and must be completed before the active investigation phase begins.

Question 8

What is the following command trying to accomplish?

Accepted Answer

A

Explanation: The command includes the UDP-specific switch (e.g., nmap -sU -p 445 192.168.0.0/24 or nc -vz -u 192.168.0.0 445). The “-sU” / “-u” flag forces a UDP probe to destination port 445 across the 192.168.0.0 network. If a UDP response or ICMP “port-unreachable” is not returned, the port is considered “open” or “open|filtered.” Therefore, the command’s goal is to verify whether UDP port 445 (Microsoft-DS/SMB) is open on hosts in the 192.168.0.0 subnet.

Question 9

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator
from their various activity. After a computer has been compromised by a hacker, which of the
following would be most important in forming a profile of the incident?

Accepted Answer

B

Explanation: Attacker profiling involves analyzing evidence to understand the perpetrator's characteristics, such as skill level, resources, motivation, and potential identity. The code used in an attack is a direct artifact created by the attacker. Its logic, complexity, formatting, and any unique algorithms or errors act as a "fingerprint." Security analysts use these code-level characteristics (a practice related to stylometry) to differentiate between threat actors, link campaigns, and assess the sophistication of the adversary. This makes the analysis of the code itself the most crucial element for building a detailed and accurate profile of the attacker.

Question 10

One technique for hiding information is to change the file extension from the correct one to one that
might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so
that a picture file appears to be a document. What can an investigator examine to verify that a file
has the correct extension?

Accepted Answer

B

Explanation: The file header is the initial section of a file's data that contains metadata about the file format. This metadata includes a specific sequence of bytes known as a "magic number" or file signature, which uniquely identifies the file type. Forensic investigators and software applications read this header to determine the true nature of a file, irrespective of its user-assigned extension. For instance, a JPEG file will always begin with the hexadecimal signature FF D8 FF, allowing an investigator to identify it as an image file even if it is renamed with a .doc extension.

Question 11

Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and
folders on a victim system to consume the available disk space. What type of test would confirm his
claim?

Accepted Answer

A

Explanation: File fingerprinting, also known as file hashing, is the process of generating a unique cryptographic hash value (e.g., MD5, SHA-256) for a file. This hash serves as a unique identifier or "fingerprint." To confirm the suspicion that malware is creating copies of files, an investigator would hash all files on the victim system. Files with identical hash values are exact duplicates, regardless of their names or locations. By identifying a large number of duplicate files, Chong-lee can confirm his claim that the malware's purpose is to consume disk space by continuously making copies. This method directly analyzes the state of the compromised disk to find evidence of file duplication.

Question 12

The MD5 program is used to:

Accepted Answer

D

Explanation: The MD5 program implements the Message Digest 5 algorithm, a cryptographic hash function. In digital forensics, its primary purpose is to ensure data integrity. An MD5 hash, a unique 128-bit value, is generated from the original evidence (e.g., a disk image). This hash acts as a digital fingerprint. If the evidence is copied or examined, the hash can be recalculated. If the new hash matches the original, it provides mathematical proof that the data has not been altered, which is crucial for maintaining the chain of custody and the admissibility of evidence.

Question 13

Which is a standard procedure to perform during all computer forensics investigations?

Accepted Answer

A

Explanation: A fundamental procedure in computer forensics is to preserve the integrity of the original evidence. Booting a suspect computer from its internal hard drive will alter data, including file access times, log files, and temporary files, thereby contaminating the evidence. The standard practice is to first remove the evidence drive. Subsequently, the investigator can safely power on the system to enter the BIOS/UEFI and document the system's date and time stored in the CMOS. This recorded time is critical for establishing a correct timeline of events, as it provides the baseline against which all file timestamps on the evidence drive will be compared.

Question 14

Event correlation is the process of finding relevance between the events that produce a final result.
What type of correlation will help an organization to correlate events across a set of servers, systems,
routers and network?

Accepted Answer

C

Explanation: Cross-platform correlation is the process of analyzing and linking log data and events from heterogeneous sources across an entire IT infrastructure. This includes correlating data from different operating systems (e.g., Windows servers, Linux systems), network hardware (e.g., routers, firewalls from various vendors), and applications. The goal is to create a comprehensive and unified view of security incidents that may span multiple, diverse systems, which is essential for effective digital forensics and incident response. This approach allows an investigator to trace the full lifecycle of an attack as it moves across different parts of the network.

Question 15

Sectors are pie-shaped regions on a hard disk that store dat a. Which of the following parts of a hard disk do not contribute in determining the addresses of data?

Accepted Answer

B

Explanation: The physical address of data on a traditional hard disk drive (HDD) is determined by its geometry, which is defined by the Cylinder-Head-Sector (CHS) addressing scheme. A cylinder specifies the track position across all platters, the head specifies the particular platter surface, and the sector specifies the exact block of data on that track. The interface (e.g., SATA, PATA, SCSI) is the communication protocol and physical connection used to transfer data between the disk and the computer. While it translates logical block addresses (LBA) to physical CHS coordinates, the interface itself is not a component of the physical data address on the disk platters.

Free ECcouncil 312-49v10 Actual Exam Questions