312-49v10 Exam Question 116

Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?
  • 312-49v10 Exam Question 117

    When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:
  • 312-49v10 Exam Question 118

    Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?
  • 312-49v10 Exam Question 119

    When marking evidence that has been collected with the "aaa/ddmmyy/nnnn/zz" format, what does the "nnnn" denote?
  • 312-49v10 Exam Question 120

    Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.