nerdexam
EC-CouncilEC-Council

312-49 · Question #374

312-49 Question #374: Real Exam Question with Answer & Explanation

Sign in or unlock 312-49 to reveal the answer and full explanation for question #374. The question stem and answer options stay visible for context.

Submitted by chen.hong· Apr 18, 2026Computer Forensics Investigation Process

Question

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question wheather evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

Options

  • ASign a statement attesting that the evidence is the same as it was when it entered the lab
  • BThere is no reason to worry about this possible claim because state labs are certified
  • CMake MD5 hashes of the evidence and compare it to the standard database developed by NIST
  • DMake MD5 hashes of the evidence and compare it with the original MD5 hash that was taken

Unlock 312-49 to see the answer

You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#Evidence Integrity#Hashing#MD5#Digital Forensics Principles
Full 312-49 PracticeBrowse All 312-49 Questions