EC-Council 312-49 Practice Exam

• A. Raw-format imaging
• B. Bit-stream imaging
• C. Logical acquisition Correct answer
• D. Live acquisition

Option C is correct because a logical acquisition copies only selected files and folders, such as one user's mailbox. Raw and bit-stream imaging (A, B) copy the whole disk sector by sector, and live acquisition (D) describes the system state during capture rather than the scope of data collected.

• A. Remove the drive, then image it behind a write blocker
• B. Shut down cleanly, then image the encrypted disk
• C. Capture RAM, then image the unlocked volume Correct answer
• D. Pull the power, then image the locked drive

Option C is correct because the decryption key and unlocked volume exist only while the machine runs, so the examiner captures RAM first and then images the unlocked volume. Shutting down, pulling power or removing the drive (A, B, D) leaves only encrypted data that cannot be read without the key.

• A. Connect the drive to a Windows workstation with the registry write-protect set, copy the profile, then hash it
• B. Attach the drive to a hardware write blocker, create a bit-stream image, then hash the source and the image Correct answer
• C. Mount the drive read-only on a Linux workstation, copy the allocated files to external storage, then hash the copies
• D. Boot the laptop from a forensic live USB, copy the user profile folders, then hash the copied folders

Option B is correct because a hardware write blocker prevents any write to the source, and a bit-stream image captures unallocated space and slack, with the source and image hashes proving the copy matches. Options A, C and D copy only allocated files or profiles, so they miss unallocated space and slack, and A and D also rely on weaker or no write protection.

• A. Shut the server down cleanly, then capture memory from the hibernation file, then image the disk
• B. Run a full antivirus scan to flag the process, then capture memory, then image the disk
• C. Image the disk first, then capture memory, then record network state using the utilities already installed on the server
• D. Capture memory first, then record network state, then image the disk with a tool run from trusted external media Correct answer

Option D is correct because evidence is acquired from most to least volatile: RAM first, then network state, then the disk, using trusted tools from external media. Shutting down (A) destroys memory, an antivirus scan (B) alters the system, and imaging the disk first (C) lets volatile data change or vanish while the slower disk copy runs.

• A. Be named in a court order for that device
• B. Be certified by the device manufacturer
• C. Be a sworn officer of the investigating agency
• D. Be competent to explain what the actions mean Correct answer

Option D is correct because ACPO Principle 2 requires that anyone accessing original data be competent to do so and able to explain the relevance and implications of their actions. A court order, manufacturer certification or sworn-officer status (A, B, C) is not what the principle requires.

• A. Authenticity
• B. Reliability
• C. Completeness
• D. Relevance Correct answer

Option D is correct because relevance is the characteristic of evidence that makes a fact in dispute more or less probable. Authenticity concerns whether an item is what it is claimed to be, reliability concerns trustworthiness of the method or source, and completeness concerns whether the full context is shown.

• A. Competence of the examiner to offer an opinion
• B. Relevance of the log to the disputed facts
• C. Authenticity of the log as a genuine record Correct answer
• D. Completeness of the conversation around the excerpt

Option C is correct because a challenge that nobody has shown the log is what the proponent claims is a challenge to authenticity. Relevance, examiner competence and completeness address different questions: whether the log bears on the case, whether the witness is qualified, and whether the excerpt is fair.

• A. The log is hearsay because it sat in digital storage, while the email is not a statement made by a person
• B. Both are hearsay, so each needs a business records foundation from a custodian before the court can admit it
• C. Neither is hearsay, since a computer stored both items and the examiner acts as the declarant for each
• D. The log is not a person's statement, while the email is hearsay unless an exclusion or exception applies Correct answer

Option D is correct because hearsay is an out-of-court statement made by a person, and automatically generated server logs are not a person's statement. The email is a person's out-of-court statement offered for its truth, so it is hearsay unless an exclusion or exception applies.

• A. Rebuild the MBR, then image the repaired disk
• B. Image the 0xEE partition, then mount it read-only
• C. Carve the disk, then rebuild the partitions
• D. Read the GPT header, then list the real partitions Correct answer

Option D is correct because a single 0xEE partition is a protective MBR, which means the disk is really GPT-partitioned. The examiner reads the GPT header to list the real partitions. Rebuilding the MBR, imaging the placeholder partition or carving (A, B, C) would misrepresent or damage a healthy layout.

• A. A remote interactive session such as RDP Correct answer
• B. A service starting under its own account
• C. A network share connection from another host
• D. A local console logon at the keyboard

Option A is correct because Event ID 4624 with logon type 10 is a RemoteInteractive logon, such as Remote Desktop. A service logon is type 5, a network share logon is type 3, and a local console logon is type 2 (B, C, D).

• A. The camera saved the tags in a sidecar file
• B. The photographer disabled location services
• C. The image was converted from a BMP file
• D. The site removed the metadata during upload Correct answer

Option D is correct because social media platforms routinely strip EXIF metadata, including camera model and GPS tags, when they re-encode uploaded images to protect user privacy and reduce file size. A sidecar file (A) is a RAW-workflow convention, not something a JPEG camera output relies on, a user disabling location services (B) would remove only GPS and not the camera model, and a BMP conversion (C) cannot be inferred from missing tags alone.

• A. Enable write protection on the evidence media
• B. Create a second copy as contingency
• C. Validate the data acquisition Correct answer
• D. Select the data acquisition tool

Option C is correct because validating the acquisition, by comparing hash values of the source and the acquired image, is the final step in the EC-Council data acquisition methodology. Selecting the tool and enabling write protection come early, and the contingency copy is made before the validation that confirms the image is complete and unaltered.

• A. Copy the image to new media, then hash it against the source
• B. Re-image the source, then discard the first image
• C. Document that the source was live, then verify the image against its acquisition hash Correct answer
• D. Power off the source, then compare its new hash

Option C is correct because a live volume changes while it is imaged, so a later source hash will not match the image. The examiner documents that the source was live and verifies the image against the hash computed at acquisition. Hashing a copy against the changed source, or re-imaging or powering off (A, B, D), does not resolve the mismatch and may destroy evidence.

• A. Review
• B. Production
• C. Processing Correct answer
• D. Preservation

Option C is correct because in the EDRM model the stage after Collection is Processing, where collected data is prepared for review. Review and Production come later, and Preservation comes before Collection (A, B, D).

• A. The desktop.ini file
• B. The $R file
• C. The $I file Correct answer
• D. The INFO2 file

Option C is correct because the $I file in the Windows Recycle Bin stores the original path, size and deletion time, while the $R file holds the deleted content itself. INFO2 is the older Recycle Bin format used before Vista, and desktop.ini holds folder settings (A, B, D).

• A. ShellBags, stored in the user's registry hives Correct answer
• B. Amcache, stored in the Amcache.hve file
• C. SRUM, stored in the SRUDB.dat database
• D. Prefetch, stored in the Windows Prefetch folder

Option A is correct because ShellBags are stored in the user's registry hives and record folders a user browsed in Explorer, including folders on removable drives that are no longer attached. Amcache, SRUM and Prefetch (B, C, D) record program execution or resource usage, not folder browsing.

• A. In the -wal file beside the database Correct answer
• B. In the sqlite_master table
• C. In the rollback journal of the app
• D. In the freelist pages of the database

Option A is correct because SQLite in WAL mode writes new transactions to the -wal file first and only merges them into the main database at a checkpoint, so recent messages can exist only there. The rollback journal is not used in WAL mode, and sqlite_master and freelist pages (B, C, D) are not where the newest committed rows live.

• A. pstree
• B. psscan Correct answer
• C. pslist
• D. netscan

Option B is correct because psscan scans memory for EPROCESS structures rather than following the active process list, so it finds processes hidden by unlinking. pslist and pstree (A, C) walk the linked list and miss them, and netscan (D) lists network connections.

• A. Keyword Search
• B. Extension Mismatch Detector Correct answer
• C. Recent Activity
• D. Hash Lookup

Option B is correct because the Extension Mismatch Detector ingest module compares a file's signature with its extension and flags a JPEG renamed to .xls. Keyword Search, Recent Activity and Hash Lookup (A, C, D) do not compare signatures with extensions.

• A. One fixed partition size set at creation
• B. Pooled free space of the container Correct answer
• C. A single file system journal
• D. The same user encryption key

Option B is correct because an APFS container holds a single pool of free space that all of its volumes draw from, so each volume grows and shrinks as needed. Volumes do not have fixed partition sizes (A), they keep their own snapshots rather than one shared journal (C), and each volume can have its own encryption key (D).