312-49

312-49 practice questions, page 17 of 22, with answer review and explanations.

Question 81

When you carve an image, recovering the image depends on which of the following skills?

  1. Recognizing the pattern of the header content
  2. Recovering the image from a tape backup
  3. Recognizing the pattern of a corrupt file
  4. Recovering the image from the tape backup

Question 82

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

  1. A Capital X
  2. A Blank Space
  3. The Underscore Symbol
  4. The lowercase Greek Letter Sigma (s)

Question 83

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

  1. Keep the information of file for later review
  2. Destroy the evidence
  3. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
  4. Present the evidence to the defense attorney

Question 84

In Microsoft file structures, sectors are grouped together to form:

  1. Clusters
  2. Drives
  3. Bitstreams
  4. Partitions

Question 85

What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?

  1. A compressed file
  2. A Data stream file
  3. An encrypted file
  4. A reserved file