MENU
You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?
Suggested Answer: D
Get Premium 312-49 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
17 comments · newest first
LU
Lura
11 months ago
Just document your findings and keep digging for clues!
TO
Toshia
11 months ago
I disagree, loading utilities offline might not give you the full picture.
GE
German
11 months ago
Surprised there's no evidence in the registry. Seems odd.
TE
Tequila
12 months ago
Definitely look for repeating patterns on the drive! That could be key.
KA
Kati
12 months ago
I think checking the list of installed programs is a solid move.
TO
Torie
1 year ago
I feel like documenting the suspicion is important, but it doesn't really prove anything without evidence.
JE
Jesus
1 year ago
Loading drive wiping utilities offline sounds risky, but I guess it could show previous activity.
MO
Monroe
1 year ago
I think checking the installed programs could help, but what if the software was uninstalled?
TA
Tanja
1 year ago
I remember we discussed looking for patterns on the hard drive, but I'm not sure if that's the best approach here.
BE
Benton
1 year ago
Ah, I see. Checking for repeating patterns at the bit level could be a good way to detect if a wiping tool was used. I'll make sure to explore that option.
SH
Shay
1 year ago
Okay, I think I've got a strategy here. I'll try loading some known drive wiping tools offline and see if I can find any traces of their previous runs.
AL
Alba
1 year ago
Hmm, I'm a bit unsure about this. I'll need to review the material on drive wiping techniques and see if I can find a reliable way to detect it.
JO
Josefa
1 year ago
This seems like a tricky one. I'll need to think carefully about the best approach to verify the use of a drive wiping utility.
DO
Dottie
1 year ago
I'm not sure, but I think CIDR can only be changed by deleting and recreating the VNet, right? That sounds risky for connectivity.
TO
Tonette
1 year ago
I'm a little confused by this question. Is the Indexer responsible for access control, or is it more of a data storage component? I'm not sure which Splunk component would be best for implementing this policy.
SH
Shayne
1 year ago
Hmm, this looks like a tricky one. I'll need to think carefully about the different ways to handle partial messages in a WebSocket application.
TA
Tamesha
1 year ago
I think the answer is D. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO).