In the context of file deletion process, which of the following statement holds true?

What must an investigator do before disconnecting an iPod from any type of computer?

What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

What is one method of bypassing a system BIOS password?

When using an iPod and the host computer is running Windows, what file system will be used?

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes.

What type of activity is the investigator seeing?

The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term?

You are working in the Security Department of a law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss.

What port do you send the email to on the company SMTP server?