312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 13 of 18, with answer review and explanations.

Question 61

Which "Standards and Criteria" under SWDGE states that "the agency must use hardware and software that are appropriate and effective for the seizure or examination procedure"?

  1. Standards and Criteria 1.4
  2. Standards and Criteria 1.5
  3. Standards and Criteria 1.6
  4. Standards and Criteria 1.7

Question 62

A call detail record (CDR) provides metadata about calls made over a phone service. From the following data fields, which one is not contained in a CDR.

  1. A unique sequence number identifying the record
  2. The call duration
  3. Phone number receiving the call
  4. The language of the call

Question 63

"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?

  1. Principle 1
  2. Principle 2
  3. Principle 3
  4. Principle 4

Question 64

On NTFS file system, which of the following tools can a forensic investigator use in order to identify timestomping of evidence files?

  1. Exiv2
  2. analyzeMFT
  3. Timestomp
  4. wbStego

Question 65

Matthew has been assigned the task of analyzing a suspicious MS Office document via static analysis over an Ubuntu-based forensic machine. He wants to see what type of document it is, whether it is encrypted, or contains any flash objects/VBA macros. Which of the following python-based script should he run to get relevant information?

  1. oleid.py
  2. oleform.py
  3. oledir.py
  4. pdfid.py