EC-COUNCIL EC-Council Digital Forensics Essentials (DFE) - 112-57 Exam Questions

QUESTION NO: 1
Jack, a forensic investigator, was appointed to investigate a Windows-based security incident. In this process, he employed an Autopsy tool to recover the deleted files from unallocated space, which helps in gathering potential evidence.
Which of the following functions of Autopsy helped Jack recover the deleted files?

QUESTION NO: 2
Which of the following acts was passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?

QUESTION NO: 3
Which of the following MAC forensic data components saves file information and related events using a token with a binary structure?

QUESTION NO: 4
Which of the following file systems of Windows replaces the first letter of a deleted file name with the hex byte code "e5h"?

QUESTION NO: 5
Which of the following layers of the TCP/IP model includes protocols such as Frame Relay, SMDS, Fast Ethernet, SLIP, PPP, FDDI, ATM, Ethernet, and ARP to enable a machine to deliver the desired data to other hosts in the same network?

QUESTION NO: 6
Which of the following network protocols creates secure tunneling through which content obfuscation can be achieved?

QUESTION NO: 7
Bob, a forensic investigator, was instructed to review a Windows machine and identify any anonymous activities performed using it. In this process, Bob used the command "netstat -ano" to view all the active connections in the system and determined that the connections established by the Tor browser were closed.
Which of the following states of the connections established by Tor indicates that the Tor browser is closed?

QUESTION NO: 8
While investigating a web attack on a Windows-based server, Jessy executed the following command on her system:
C:> net view <\10.10.10.11>
What was Jessy's objective in running the above command?