Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image?

• A.gif
• B.bmp
• C.png
• D.jpeg

Comment: *

Name: *

Email: *

Verification: *

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?
dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

• A.Fill the disk with zeros
• B.Copy files from the master disk to the slave disk on the secondary IDE controller
• C.Low-level format
• D.Fill the disk with 4096 zeros

Comment: *

Name: *

Email: *

Verification: *

What is cold boot (hard boot)?

• A.It is the process of restarting a computer that is already turned on through the operating system
• B.It is the process of restarting a computer that is already in sleep mode
• C.It is the process of shutting down a computer from a powered-on or on state
• D.It is the process of starting a computer from a powered-down or off state

Comment: *

Name: *

Email: *

Verification: *

Tasklist command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following tasklist commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

• A.tasklist /p
• B.tasklist /s
• C.tasklist /u
• D.tasklist /v

Comment: *

Name: *

Email: *

Verification: *

Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?

• A.bench warrant
• B.search warrant
• C.wire tap
• D.subpoena

Comment: *

Name: *

Email: *

Verification: *