Computer Forensics in Today's World
5 practice questions under this official exam objective (312-49v10) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Which Perl Script Accesses a Process Executable Image?
This CHFI 312-49v10 question tests knowledge of the small Perl utility scripts used during live process analysis to locate a process's executable imag
Federal Rule of Evidence 1002 and Original Evidence
Federal Rule of Evidence 1002 is the best-evidence rule requiring that an original writing, recording, or photograph be produced to prove its content,
Where MSSQL Database Logs Are Stored
When hunting for attack evidence in an MSSQL database, an examiner must locate the transaction log, which records every change made to the database. T
Which Item Is NOT Considered Physical Evidence?
Physical evidence in computer forensics means tangible objects that can be seized, handled and preserved with a chain of custody. This page confirms t
What Type of Cipher Uses a Hole-Punched Plastic Template?
A plastic sheet with holes cut out and found at multiple suspects' desks is a grille cipher template, not a null cipher or semagram. This page establi