An analyst is investigating a case of intellectual property theft. The suspect allegedly emailed a confidential document to a personal account. Which forensic technique would most likely reveal evidence of this activity?

Analyzing the Windows registry for recently opened documents

Reviewing the firewall logs for outbound SMTP traffic

Examining the email client's sent items and mailbox files

Carving the entire hard drive for image files

During a forensic examination, an analyst is searching for deleted files on a Windows system. The analyst needs to recover files that were deleted from the Recycle Bin. Which technique should the analyst use?

Examining the Windows registry for deleted file entries

Carving the unallocated space of the hard drive

Analyzing network packet captures

A forensic investigator is handling a case where the suspect's computer was used to access a cloud storage account. The investigator has the computer's hard drive image. Which additional evidence source is most critical to preserve?

The browser's autocomplete cache

The cloud provider's access logs and account metadata

Why is it important to document the tools and methods used during a computer forensics investigation?

To ensure the investigation can be reproduced and the findings verified by another expert

To satisfy the requirements of the software license agreements

To keep the investigation process confidential from the opposing counsel

To prove that the investigator used the most expensive tools available

EC-CouncilCertified Security Specialist

Domain 5Objective 2

Computer Forensics Investigation Process ECSS Practice Questions (Page 6)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

44questions here

9free pages

5concepts

Questions 26–30

26application · medium
An analyst is investigating a case of intellectual property theft. The suspect allegedly emailed a confidential document to a personal account. Which forensic technique would most likely reveal evidence of this activity?
Select an answer first
27application · medium
During a forensic examination, an analyst is searching for deleted files on a Windows system. The analyst needs to recover files that were deleted from the Recycle Bin. Which technique should the analyst use?
Select an answer first
28expert · hard
A forensic investigator is handling a case where the suspect's computer was used to access a cloud storage account. The investigator has the computer's hard drive image. Which additional evidence source is most critical to preserve?
Select an answer first
29foundation · easy
During which phase of a computer forensics investigation does the investigator typically create a bit-for-bit copy of the storage media?
Select an answer first
30foundation · easy
Why is it important to document the tools and methods used during a computer forensics investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.