EC-CouncilEC-Council
312-49 · Question #413
312-49 Question #413: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49 to reveal the answer and full explanation for question #413. The question stem and answer options stay visible for context.
Submitted by yaw92· Apr 18, 2026Disk Forensics
Question
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?
Options
- AA disk imaging tool would check for CRC32s for internal self checking and validation and have
- BEvidence file format will contain case data entered by the examiner and encrypted at the
- CA simple DOS copy will not include deleted files, file slack and other information
- DThere is no case for an imaging tool as it will use a closed, proprietary format that if compared to
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Digital Forensics Basics#Evidence Acquisition#Disk Imaging#Forensic Best Practices