312-49v9 Practice Test

Which Is a Linux journaling file system?

A.

Ext3

B.

HFS

C.

FAT

D.

BFS

When collecting electronic evidence at the crime scene, the collection should proceed from
the most volatile to the least volatile

A.

True

B.

False

Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where, “X”
represents the _________.

A.

Drive name

B.

Sequential number

C.

Original file name's extension

D.

Original file name

When collecting evidence from the RAM, where do you look for data?

A.

Swap file

B.

SAM file

C.

Data file

D.

 Log file

Which of the following is not a part of disk imaging tool requirements?

A.

The tool should not change the original content

B.

The tool should log I/O errors in an accessible and readable form, including the type and
location of the error

C.

The tool must have the ability to be held up to scientific and peer review

D.

The tool should not compute a hash value for the complete bit stream copy generated
from an image file of the source