READ Free Dumps For ECCouncil- EC0-349
| Question ID 21288 | The offset in a hexadecimal code is: |
| Option A | The 0x at the beginning of the code |
| Option B | The first byte after the colon |
| Option C | The last byte after the colon |
| Option D | The 0x at the end of the code |
| Correct Answer | A |
| Question ID 21289 | What does mactime, an essential part of the coroner's toolkit do? |
| Option A | It is a tool specific to the MAC OS and forms a core component of the tool kit |
| Option B | It traverses the file system and produces a listing of all files based on the modification, access and change |
| Option C | The toolsscans for i-node information, which is used by other tools in the tool kit |
| Option D | It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them |
| Correct Answer | B |