Eccouncil Exam 312-49 Topic 1 Question 63 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 63
Topic #: 1

You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?

ADocument in your report that you suspect a drive wiping utility was used, but no evidence was found

BCheck the list of installed programs

CLoad various drive wiping utilities offline, and export previous run reports

DLook for distinct repeating patterns on the hard drive at the bit level

Show Suggested Answer

Suggested Answer: D

by Casey at Aug 07, 2024, 11:33 PM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ty

3 months ago

Looking for distinct repeating patterns on the hard drive at the bit level sounds like a solid approach to verify the use of drive wiping software.

upvoted 0 times

...

Jonelle

3 months ago

I believe loading drive wiping utilities offline and exporting previous run reports would be more conclusive.

upvoted 0 times

...

Alyce

3 months ago

I'm picturing Option C, but with the investigators wearing those sleek black suits and sunglasses. You know, for maximum cool factor.

upvoted 0 times

Roslyn

3 months ago

C) Load various drive wiping utilities offline, and export previous run reports

upvoted 0 times

...

Verdell

3 months ago

A) Document in your report that you suspect a drive wiping utility was used, but no evidence was found

upvoted 0 times

...

Gladys

3 months ago

Option A? Really? That's like saying, 'Hey, I think a crime was committed, but I have no proof.' Not very investigative, if you ask me.

upvoted 0 times

...

4 months ago

I'm going with Option B. You can't hide a program install, even if it's been wiped. Those registry keys will tell all!

upvoted 0 times

Mozell

3 months ago

Agreed, that could be a clear indicator of what was used on the hard drive.

upvoted 0 times

...

Myong

3 months ago

It's a smart move to look for traces in the installed programs list.

upvoted 0 times

...

Elly

3 months ago

Yeah, that could definitely reveal if a drive wiping utility was used.

upvoted 0 times

...

Ludivina

3 months ago

I think checking the list of installed programs is a good idea.

upvoted 0 times

...

4 months ago

Option D sounds legit. I've heard that drive wipers can leave distinct patterns on the drive that a forensic investigator can detect. Guess I'll have to trust the experts on this one!

upvoted 0 times

Shantay

3 months ago

I think it's important to explore all possible avenues when conducting forensic investigations to ensure accuracy and thoroughness.

upvoted 0 times

...

Willard

3 months ago

It's definitely a meticulous process, but it can provide valuable insights into whether the drive was wiped or not.

upvoted 0 times

...

Elinore

4 months ago

I agree, looking for distinct repeating patterns on the hard drive at the bit level seems like a solid way to verify if drive wiping software was used.

upvoted 0 times

...

Lucia

4 months ago

Option D sounds legit. I've heard that drive wipers can leave distinct patterns on the drive that a forensic investigator can detect. Guess I'll have to trust the experts on this one!

upvoted 0 times

...