EC-Council
312-49V11 · Question #74
312-49V11 Question #74: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49V11 to reveal the answer and full explanation for question #74. The question stem and answer options stay visible for context.
Question
Ethan, a forensic investigator, is analyzing a suspect's computer and finds a suspicious file that may be related to a cybercrime. Upon examining the file's metadata, Ethan discovers that the file has been modified several times and was last accessed shortly before the crime took place. Which of the following forensic methods would be most useful for Ethan to determine whether the file was tampered with or manipulated?
Options
- AReview the file's file system logs
- BLook for hidden attributes or alternate data streams
- CCheck the file's access control list (ACL)
- DExamine the file's hash value
Unlock 312-49V11 to see the answer
You've previewed enough free 312-49V11 questions. Unlock 312-49V11 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.