Get the Latest 112-57 Exam Dumps (V8.02) for 20206 – Pass Your EC-Council Digital Forensics Essentials (DFE) Exam Successfully

1. Jack, a forensic investigator, was appointed to investigate a Windows-based security incident. In this process, he employed an Autopsy tool to recover the deleted files from unallocated space, which helps in gathering potential evidence.

Which of the following functions of Autopsy helped Jack recover the deleted files?

2. Which of the following file systems of Windows replaces the first letter of a deleted file name with the hex byte code “e5h”?

3. Identify the malware analysis technique in which the investigators must take a snapshot of the baseline state of the forensic workstation before malware execution.

4. Which of the following hives in the Windows Registry hierarchical database is volatile in nature and contains file-extension association information and programmatic identifier (ProgID), Class ID (CLSID), and Interface ID (IID) data?

5. Which of the following commands can an investigator use to parse GPTs of both types of hard disks, including those formatted with either UEFI or MBR?

6. Cheryl, a forensic expert, was recruited to investigate a malicious activity performed by an anonymous hackers’ group on an organization’s systems. Using an automated tool, Cheryl was able to extract the malware file and analyze the assembly code instructions, which helped him understand the malware’s purpose.

Which of the following tools helped Cheryl extract and analyze the assembly code of the malware?

7. Below are the elements included in the order of volatility for a typical computing system as per the RFC 3227 guidelines for evidence collection and archiving.

Archival media

Remote logging and monitoring data related to the target system

Routing table, process table, kernel statistics, and memory

Registers and processor cache

Physical configuration and network topology

Disk or other storage media

Temporary system files

Identify the correct sequence of order of volatility from the most to least volatile for a typical system.

8. Bob, a professional hacker, targeted an organization to launch attacks. Bob gathered information

such as network topology and a list of live hosts. Based on the collected information, he launched further attacks over the organization’s network.

Identify the type of network attack Bob initiated on the target organization in the above scenario.

9. 1.Wesley, a professional hacker, deleted a confidential file in a compromised system using the “/bin/rm/” command to deny access to forensic specialists.

Identify the operating system on which Don has performed the file carving act.

10. Which of the following network protocols creates secure tunneling through which content obfuscation can be achieved?

11. An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose, Steven, a security analyst, was instructed to deploy a device to bait attackers. Steven selected a solution that appears to contain very useful information to lure attackers and find their locations and techniques.

Identify the type of device deployed by Steven in the above scenario.

12. Alice and John are close college friends. Alice frequently sends emails to John attaching her pics with friends. One day, Alice sent an email to John describing all the details related to the final year project without specifying the actual purpose. John missed the message as he frequently receives emails from her and did not arrive for a project seminar.

Which of the following email fields could Alice have used in the above scenario to highlight the importance of the email?

13. An investigator wants to extract information about the status of the network interface cards (NICs) in an organization’s Windows-based systems. Identify the command-line utility that can help the investigator detect the network status.

14. Which of the following MAC forensic data components saves file information and related events using a token with a binary structure?

15. Jack, a forensic investigator, was appointed by an organization to perform a security audit on a Linux system. In this process, Jack collected information about the present status of the system and listed all the applications running on various ports to detect malicious programs.

Which of the following commands can help Jack determine any programs/processes associated with open ports?

16. Which of the following file systems is developed by Apple to support Mac OS in its proprietary Macintosh system and replace the Macintosh File System (MFS)?

17. Bob, a security specialist at an organization, extracted the following IIS log from a Windows-based server:

“2019-12-12 06:11:41 192.168.0.10 GET /images/content/bg_body1.jpg - 80 - 192.168.0.27 Mozilla/5.0+(Windows+NT+6.3;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/48. 0.2564.103+Safari/537.36 http://www.moviescope.com/css/style.css 200 0 0 365”

Identify the element in the above IIS log entry that indicates the request was fulfilled without error.

18. Which of the following measures is defined as the time to move read or write disc heads from one point to another on the disk?

19. Which of the following titles of The Electronic Communications Privacy Act protects the privacy of the contents of files stored by service providers and records held about the subscriber by service providers, such as subscriber name, billing records, and IP addresses?

20. Andrew, a system administrator, is performing a UEFI boot process. The current phase of the UEFI boot process consists of the initialization code that the system executes after powering on the EFI system. This phase also manages platform reset events and sets up the system so that it can find, validate, install, and run the PEI.

Which of the following UEFI boot phases is the process currently in?

21. In which of the following malware distribution techniques does the attacker use tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to improve the search-engine ranking of their malware pages?

22. A disk drive has 16,384 cylinders, 80 heads, and 63 sectors per track, and each sector can store 512 bytes of data.

What is the total size of the disk?

23. Which of the following techniques is defined as the art of hiding data “behind” other data without the target’s knowledge, thereby hiding the existence of the message itself?

24. Benoy, a security professional at an organization, extracted Apache access log entries to view critical information about all the operations performed on a web server.

The Apache access log extracted by Benoy is given below:

“10.10.10.10 - Jason [17/Aug/2019:00:12:34 +0300] "GET /images/content/bg_body_1.jpg HTTP/1.0" 500 1458”

Identify the HTTP status code in the Apache access log entry above that indicates the response was successful.

25. Which of the following tools helps forensic experts analyze user activity in the Microsoft Edge browser?

26. Which of the following tools helps a forensics investigator develop and test across multiple operating systems in a virtual machine for Mac and allows access to Microsoft Office for Windows?

27. Which of the following Tor relay nodes in the Tor circuit is designed to transfer data in an encrypted format?

28. Below is the syntax of a command-line utility that displays active TCP connections and ports on which the computer is listening.

netstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval]

Identify the netstat parameter that displays active TCP connections and includes the process ID (PID) for each connection.

29. Bob, a forensic investigator, is investigating a live Windows system found at a crime scene. In this process, Bob extracted subkeys containing information such as SAM, Security, and software using an automated tool called FTK Imager.

Which of the following Windows Registry hives’ subkeys provide the above information to Bob?

30. Kelly, a professional hacker, used her laptop to perform illegal cyber activities for monetary gain on many victims. She securely locked her laptop using BitLocker software. Using this tool, she locked an entire volume using a secret key to deny access to the system.

Identify the anti-forensic technique used by Don in the above scenario.