EC-Council
312-49V11 · Question #114
312-49V11 Question #114: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49V11 to reveal the answer and full explanation for question #114. The question stem and answer options stay visible for context.
Question
Jane is a forensic investigator at a top cybersecurity firm. While analyzing a suspect's computer for evidence related to a potential data breach, she came across a log file that appeared to have been tampered with. The timestamp of the file seems modified, and some parts of the file seem to have been deliberately deleted. What should Jane do first to ensure the preservation and authenticity of the digital evidence?
Options
- AShe should try to recover the deleted parts of the log file
- BShe should make a bit-stream image copy of the hard drive
- CShe should continue her analysis, taking note of the tampering
- DShe should immediately contact her supervisor and present the altered log file
Unlock 312-49V11 to see the answer
You've previewed enough free 312-49V11 questions. Unlock 312-49V11 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.