A forensic analyst is investigating a system where the user attempted to hide files by deleting them and then running a disk cleanup utility. The analyst has a forensic image. Which technique is most likely to recover the deleted files?

Restoring the system to a previous restore point.

Searching the pagefile for the file contents.

File carving based on file signatures in unallocated space.

Checking the Recycle Bin for the files.

An investigator is analyzing a forensic image of a suspect's hard drive. The investigator needs to find files that were recently deleted from the Recycle Bin and determine when they were originally created. Which approach is most effective?

Look only at the Master File Table (MFT) entries for the files.

Boot the original drive and open the Recycle Bin to view the files.

Run a quick format on the drive and then use recovery software.

Search the image for file signatures and inspect the $Recycle.Bin folder metadata.

What is the purpose of hashing a forensic image?

To encrypt the image to protect it from unauthorized access

To verify that the image is an exact copy of the original media

To compress the image to save storage space

To index the image for faster searching

Which of the following best describes the relationship between incident response and computer forensics?

Incident response is a subset of computer forensics

Computer forensics is only used after the incident is fully resolved

Incident response focuses on containing and eradicating threats, while forensics focuses on preserving and analyzing evidence

Incident response and computer forensics are unrelated processes

EC-CouncilAssociate C|CISO

Domain 4Objective 8

Computer Forensics and Incident Response ACCISO Practice Questions (Page 2)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

11concepts

11 Concepts in This Objective

Computer Forensics Fundamentals
Forensic Process and Procedures
Evidence Collection and Preservation
Forensic Imaging and Duplication
Data Recovery and Analysis
Incident Response Fundamentals
Incident Detection and Triage
Containment, Eradication, and Recovery
Legal and Ethical Considerations
Forensic Tools and Technologies
Reporting and Documentation

Questions 6–10

6foundation · easy
Which of the following is a common forensic tool used for disk imaging and analysis?
Select an answer first
7expert · hard
A forensic analyst is investigating a system where the user attempted to hide files by deleting them and then running a disk cleanup utility. The analyst has a forensic image. Which technique is most likely to recover the deleted files?
Select an answer first
8application · medium
An investigator is analyzing a forensic image of a suspect's hard drive. The investigator needs to find files that were recently deleted from the Recycle Bin and determine when they were originally created. Which approach is most effective?
Select an answer first
9foundation · easy
What is the purpose of hashing a forensic image?
Select an answer first
10foundation · easy
Which of the following best describes the relationship between incident response and computer forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.