Free EC-COUNCIL 312-49 Exam Dumps Questions & Answers

Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

• A.Local archives should be stored together with the server storage archives in order to be admissible in a court of law
• B.It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers
• C.Local archives do not have evidentiary value as the email client may alter the message data
• D.Server storage archives are the server information and settings stored on a local system, whereas the local archives are the local email client information stored on the mail server

Gary, a computer technician, is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation does this case require?

• A.Administrative Investigation
• B.Both Criminal and Administrative Investigation
• C.Criminal Investigation
• D.Civil Investigation

You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a "simple backup copy" of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a "simple backup copy" will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

• A.Incremental backup copy
• B.Robust copy
• C.Bit-stream copy
• D.Full backup copy

Which of the following is NOT a part of pre-investigation phase?

• A.Gathering information about the incident
• B.Creating an investigation team
• C.Building forensics workstation
• D.Gathering evidence data

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

• A.user account that was used to send the account
• B.contents of the e-mail message
• C.attachments sent with the e-mail message
• D.unique message identifier
• E.date and time the message was sent