Eccouncil Exam 212-89 Topic 4 Question 47 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 47
Topic #: 4

Farheen is an incident responder at reputed IT Firm based in Florid

a. Farheen was asked to investigate a recent cybercrime faced by the organization. As part of this process, she collected static data from a victim system. She used DD tool command to perform forensic duplication to obtain an NTFS image of the original disk. She created a sector-by-sector mirror imaging of the disk and saved the output image file as image.dd.

Identify the static data collection process step performed by Farheen while collecting static data.

AComparison

BAdministrative consideration

CSystem preservation

DPhysical presentatio

Show Suggested Answer

Suggested Answer: A

by Deandrea at Aug 10, 2023, 10:25 PM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Juliann

6 days ago

Haha, DD tool? More like 'do or die' tool, am I right? But seriously, I think the answer is C - System preservation.

upvoted 0 times

...

Izetta

8 days ago

Wait, did she use the DD tool to make a mirror image? Isn't that more like physical presentation? I'm not sure about this one.

upvoted 0 times

...

Jenelle

13 days ago

This is a pretty straightforward question. Farheen used the DD tool command to perform forensic duplication, which is the correct answer - System preservation.

upvoted 0 times

...

Raylene

17 days ago

I believe it could also be Administrative consideration, as ensuring proper documentation and chain of custody is important in cybercrime investigations.

upvoted 0 times

...

Stephaine

18 days ago

I agree with Merrilee, System preservation is crucial in forensic investigations to ensure the integrity of the evidence.

upvoted 0 times

...

Merrilee

20 days ago

I think the static data collection process step performed by Farheen is System preservation.

upvoted 0 times

...