Exam 312-49 topic 1 question 102 discussion

Actual exam question from ECCouncil's 312-49

Question #: 102
Topic #: 1

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

A. A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
C. A simple DOS copy will not include deleted files, file slack and other information
D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

Show Suggested Answer

Suggested Answer: C 🗳️

by larajorge at April 18, 2021, 3:35 p.m.

Comments

Submit Cancel

simbai

7 months, 2 weeks ago

I would like to agree with larajorge on this one. The answer should be A

upvoted 1 times

...

larajorge

2 years, 6 months ago

I believe answer should be A. The question asks why I would recommend a disk imaging tool, it is not asking what is the issue with a DOS copy.

upvoted 1 times

Bodescu

2 years, 6 months ago

A disk imaging tool not necessarily will check for CRC32s and not even is a requeriment in fact, to be able to perform any kind of validation by itself. But, a DOS copy will not take those elements we will need for our investigation. So, think answer is absolutly correct.

upvoted 2 times

...

Exam 312-49 All Questions

View all questions & answers for the 312-49 exam

Exam 312-49 topic 1 question 102 discussion

Comments

simbai

larajorge

Bodescu

SY0-701