CHFI Missed

CHFI Missed Questions and Answers | Latest update 100% Pass What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired? A. Every byte of the file(s) is given an MD5 hash to match against a master file B. Every byte of the file(s) is verified using 32-bit CRC C. Every byte of the file(s) is copied to three different hard drives D. Every byte of the file(s) is encrypted using three different method - B. Every byte of the file(s) is verified using 32-bit CRC What will the following command accomplish?dd if=/dev/xxx of=p bs=512 count=1 A. Back up the master boot record B. Restore the master boot record C. Mount the master boot record on the first partition of the hard drive D. Restore the first 512 bytes of the first partition of the hard drive - A. Back up the master boot record A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:RECYCLED using a command line tool but does not find anything. What is the reason for this? A. He should search in C:WindowsSystem32RECYCLED folder B. The Recycle Bin does not exist on the hard drive C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them D. Only FAT system contains RECYCLED folder and not NTFS - C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them When using an iPod and the host computer is running Windows, what file system will be used? A. iPod+ B. HFS C. FAT16 D. FAT32 - D. FAT32 Which file should be used to restore archived email messages for someone using MicrosoftOutlook? A. Outlook bak B. Outlook ost C. Outlook NK2 D. Outlook pst - D. Outlook p