312-49v10 Exam Question 116
Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?
312-49v10 Exam Question 117
When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:
312-49v10 Exam Question 118
Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?
312-49v10 Exam Question 119
When marking evidence that has been collected with the "aaa/ddmmyy/nnnn/zz" format, what does the "nnnn" denote?
312-49v10 Exam Question 120
Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.
