Eccouncil 312-49 Exam - Topic 1 Question 56 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 56
Topic #: 1

You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?

ADocument in your report that you suspect a drive wiping utility was used, but no evidence was found

BCheck the list of installed programs

CLoad various drive wiping utilities offline, and export previous run reports

DLook for distinct repeating patterns on the hard drive at the bit level

Show Suggested Answer

Suggested Answer: D

by Charlesetta at May 12, 2024, 09:09 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lura

3 months ago

Just document your findings and keep digging for clues!

upvoted 0 times

...

Toshia

3 months ago

I disagree, loading utilities offline might not give you the full picture.

upvoted 0 times

...

German

3 months ago

Surprised there's no evidence in the registry. Seems odd.

upvoted 0 times

...

Tequila

4 months ago

Definitely look for repeating patterns on the drive! That could be key.

upvoted 0 times

...

Kati

4 months ago

I think checking the list of installed programs is a solid move.

upvoted 0 times

...

Torie

4 months ago

I feel like documenting the suspicion is important, but it doesn't really prove anything without evidence.

upvoted 0 times

...

Jesus

4 months ago

Loading drive wiping utilities offline sounds risky, but I guess it could show previous activity.

upvoted 0 times

...

Monroe

4 months ago

I think checking the installed programs could help, but what if the software was uninstalled?

upvoted 0 times

...

Tanja

5 months ago

I remember we discussed looking for patterns on the hard drive, but I'm not sure if that's the best approach here.

upvoted 0 times

...

Benton

5 months ago

Ah, I see. Checking for repeating patterns at the bit level could be a good way to detect if a wiping tool was used. I'll make sure to explore that option.

upvoted 0 times

...

Shay

5 months ago

Okay, I think I've got a strategy here. I'll try loading some known drive wiping tools offline and see if I can find any traces of their previous runs.

upvoted 0 times

...

Alba

5 months ago

Hmm, I'm a bit unsure about this. I'll need to review the material on drive wiping techniques and see if I can find a reliable way to detect it.

upvoted 0 times

...

Josefa

5 months ago

This seems like a tricky one. I'll need to think carefully about the best approach to verify the use of a drive wiping utility.

upvoted 0 times

...

Dottie

5 months ago

I'm not sure, but I think CIDR can only be changed by deleting and recreating the VNet, right? That sounds risky for connectivity.

upvoted 0 times

...

Tonette

5 months ago

I'm a little confused by this question. Is the Indexer responsible for access control, or is it more of a data storage component? I'm not sure which Splunk component would be best for implementing this policy.

upvoted 0 times

...

Shayne

5 months ago

Hmm, this looks like a tricky one. I'll need to think carefully about the different ways to handle partial messages in a WebSocket application.

upvoted 0 times

...

Tamesha

5 months ago

I think the answer is D. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO).

upvoted 0 times

...