EC COUNCIL ertified Incident Handler Set 3

Which of the following is NOT a digital forensic analysis tool:

The Linux command used to make binary copies of computer media and as a disk imaging tool if given a raw disk device as its input is:

What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP addresses on a victim computer to identify the established connections on it:

What command does a Digital Forensic Examiner use to display the list of all IP addresses and their associated MAC addresses on a victim computer to identify the machines that were communicating with it:

To recover, analyze, and preserve computer and related materials in such a way that it can be presented as evidence in a court of law and identify the evidence in short time, estimate the potential impact of the malicious activity on the victim, and assess the intent and identity of the perpetrator is known as:

Any information of probative value that is either stored or transmitted in a digital form during a computer crime is called:

Electronic evidence may reside in the following:

A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media, that can be presented in a court of law in a coherent and meaningful format is called:

Incidents are reported in order to:

According to US-CERT; if an agency is unable to successfully mitigate a DOS attack it must be reported within: