EC-CouncilCertified Security Specialist
Domain 5Objective 5
Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 7)
Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.
45questions here
9free pages
8concepts
Questions 31–35
- 31
Which area of a storage device can be used to hide data because it is not normally allocated to any file?
Select an answer first - 32
A forensic examiner is analyzing a set of audio files from a suspect. The files are WAV format and have a normal duration, but the examiner notices that the file sizes are larger than expected for the audio length. What is the most likely explanation and what should the examiner do?
Select an answer first - 33
A forensic examiner is analyzing a Windows system that is suspected of hiding data in alternate data streams (ADS). The examiner has limited time and must decide which technique to use to detect ADS on the system. The system is running and the examiner has administrative access. Which technique is most efficient and effective?
Select an answer first - 34
A forensic team is acquiring evidence from a running Windows server that hosts a critical database. The server cannot be shut down because it would cause a major business outage. The team suspects that the attacker used encryption and may have left data in memory. Which acquisition strategy should the team use to maximize evidence collection while minimizing disruption?
Select an answer first - 35
Which forensic technique is used to recover data from the unallocated space of a storage device?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.