Eccouncil Exam 212-89 Topic 4 Question 47 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 47
Topic #: 4

Farheen is an incident responder at reputed IT Firm based in Florid

a. Farheen was asked to investigate a recent cybercrime faced by the organization. As part of this process, she collected static data from a victim system. She used DD tool command to perform forensic duplication to obtain an NTFS image of the original disk. She created a sector-by-sector mirror imaging of the disk and saved the output image file as image.dd.

Identify the static data collection process step performed by Farheen while collecting static data.

AComparison

BAdministrative consideration

CSystem preservation

DPhysical presentatio

Show Suggested Answer

Suggested Answer: A

by Deandrea at Aug 10, 2023, 10:25 PM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Freeman

3 months ago

Ah, the classic DD tool. It's like the Swiss Army knife of forensics, isn't it? I'm going with C - System preservation on this one.

upvoted 0 times

Laticia

2 months ago

User 3: Yeah, system preservation is crucial in maintaining the integrity of the evidence.

upvoted 0 times

...

Gail

2 months ago

User 2: I think Farheen was focusing on system preservation when she collected the static data.

upvoted 0 times

...

Glenn

2 months ago

User 1: I agree, the DD tool is definitely a versatile tool for forensics.

upvoted 0 times

...

Juliann

3 months ago

Haha, DD tool? More like 'do or die' tool, am I right? But seriously, I think the answer is C - System preservation.

upvoted 0 times

Daniel

24 days ago

System preservation is crucial in incident response investigations.

upvoted 0 times

...

Stephaine

25 days ago

D) Physical presentation

upvoted 0 times

...

Alexis

26 days ago

Farheen did a great job using the DD tool for forensic duplication.

upvoted 0 times

...

Cortney

27 days ago

C) System preservation

upvoted 0 times

...

Marge

28 days ago

B) Administrative consideration

upvoted 0 times

...

Britt

29 days ago

I agree, it's definitely important to preserve the system during data collection.

upvoted 0 times

...

Annmarie

2 months ago

A) Comparison

upvoted 0 times

...

Orville

2 months ago

Yes, you're right! DD tool is quite powerful.

upvoted 0 times

...

Izetta

3 months ago

Wait, did she use the DD tool to make a mirror image? Isn't that more like physical presentation? I'm not sure about this one.

upvoted 0 times

...

Jenelle

3 months ago

This is a pretty straightforward question. Farheen used the DD tool command to perform forensic duplication, which is the correct answer - System preservation.

upvoted 0 times

Aleta

2 months ago

System preservation was crucial in collecting static data for the investigation.

upvoted 0 times

...

Edelmira

3 months ago

Farheen used the DD tool command to perform forensic duplication, which is the correct answer - System preservation.

upvoted 0 times

...

Raylene

3 months ago

I believe it could also be Administrative consideration, as ensuring proper documentation and chain of custody is important in cybercrime investigations.

upvoted 0 times

...

Stephaine

3 months ago

I agree with Merrilee, System preservation is crucial in forensic investigations to ensure the integrity of the evidence.

upvoted 0 times

...

Merrilee

3 months ago

I think the static data collection process step performed by Farheen is System preservation.

upvoted 0 times

...