- (Exam Topic 2)
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?

1. A. Data from a CD copied using Windows
2. B. Data from a CD copied using Mac-based system
3. C. Data from a DVD copied using Windows system
4. D. Data from a CD copied using Linux system

Correct Answer: A

- (Exam Topic 3)
Consider that you are investigating a machine running an Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:Recycler. You read an entry named "Dd5.exe". What does Dd5.exe mean?

1. A. D driv
2. B. fifth file deleted, a .exe file
3. C. D drive, fourth file restored, a .exe file
4. D. D drive, fourth file deleted, a .exe file
5. E. D drive, sixth file deleted, a .exe file

Correct Answer: B

- (Exam Topic 3)
Which of the following does not describe the type of data density on a hard disk?

1. A. Volume density
2. B. Track density
3. C. Linear or recording density
4. D. Areal density

Correct Answer: A

- (Exam Topic 2)
Which password cracking technique uses every possible combination of character sets?

1. A. Rainbow table attack
2. B. Brute force attack
3. C. Rule-based attack
4. D. Dictionary attack

Correct Answer: B

- (Exam Topic 2)
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where “x” represents the
__________.

1. A. Drive name
2. B. Original file name’s extension
3. C. Sequential number
4. D. Original file name

Correct Answer: A