Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

• A.Process Monitor
• B.Internet Evidence Finder
• C.Report Viewer
• D.Hex Editor

Comment: *

Name: *

Email: *

Verification: *

What does mactime, an essential part of the coroner's toolkit do?

• A.It traverses the file system and produces a listing of all files based on the modification, access and change timestamps
• B.The tools scans for i-node information, which is used by other tools in the tool kit
• C.It is too specific to the MAC OS and forms a core component of the toolkit
• D.It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

Comment: *

Name: *

Email: *

Verification: *

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense.

• A.Subject matter specialist
• B.Witness present at the crime scene
• C.Expert in criminal investigation
• D.Expert law graduate appointed by attorney

Comment: *

Name: *

Email: *

Verification: *

Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?

• A.C:\RECYCLER
• B.C: $Recycled.Bin
• C.C:\$RECYCLER
• D.C: \$Recycle.Bin

Comment: *

Name: *

Email: *

Verification: *

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

• A./var/log/debug
• B./var/spool/cron/
• C./auth
• D./proc

Comment: *

Name: *

Email: *

Verification: *