EC0-479 Exam Dumps : EC-Council Certified Security Analyst (ECSA)

When files are deleted, the data is overwritten and the cluster marked as available

The longer a disk is inuse, the less likely it is that deleted files will be overwritten

While booting, the machine may create temporary files that can delete evidence

Secure delete programs work by completely overwriting the file in one go

Poison the DNS records with false records

Enumerate MX and A records from DNS

Enumerate domain user accounts and built-in groups

Establish a remote connection to the Domain Controller

evidence must be handled in the same way regardless of the type of case

evidence procedures are not important unless you work for a law enforcement agency

evidence in a criminal case must be secured more tightly than in a civil case

evidence in a civil case must be secured more tightly than in a criminal case