EC-Council 112-57 問題集 練習問題・模擬試験｜日本語版＆英語版対応

Explanation: The command path /bin/rm is a hallmark of UNIX/POSIX-style operating systems, where core userland utilities are commonly stored under directories such as /bin, /sbin, and /usr/bin. The utility rm (remove) is the standard UNIX command used to delete directory entries that reference a file’s data blocks on disk. This layout and command structure do not match Windows, which uses different filesystem conventions (drive letters, backslashes, and Windows-native executables) and does not provide /bin/rm as a native path. Android, while Linux-kernel-based, typically exposes shell utilities through environments like /system/bin (and newer systems may use toybox/busybox variants), not the classic /bin hierarchy expected on general-purpose UNIX systems. Between the remaining options, both Linux and macOS are UNIX-like and can include an rm command; however, in digital forensics training and examination contexts, the explicit reference to /bin/rm is most commonly used to indicate a Linux/UNIX command-line environment on a compromised host. Therefore, the best single-choice answer from the provided options is Linux (D)

Explanation: In classic hard-disk geometry, total capacity is computed from CHS parameters (Cylinders × Heads × Sectors per track) multiplied by bytes per sector. Forensic examiners learn this because it helps validate whether an image acquisition size is consistent with the physical disk geometry and to spot anomalies caused by misreported device geometry or capture errors. First compute total addressable sectors: 16,384 cylinders × 80 heads = 1,310,720 tracks (because each head provides a track per cylinder). Then multiply by sectors per track: 1,310,720 × 63 = 82,575,360 sectors. Convert sectors to bytes using the sector size: 82,575,360 sectors × 512 bytes/sector = 42,278,584,320 bytes. This matches option A exactly. In practice, modern drives often use LBA and may report different logical geometries, but the forensic principle remains the same: capacity equals the number of logical blocks times the logical block size, and CHS-style values are a structured way to perform that verification.

Explanation: In Windows forensics, analyzing Microsoft Edge user activity commonly involves extracting and correlating browser artifacts such as visited URLs, visit counts, timestamps, download references, and cached content indicators. A practical forensic approach is to use a tool that can parse and normalize history artifacts across multiple browsers, because investigations often require comparing activity between Edge and other installed browsers on the same workstation. BrowsingHistoryView is designed specifically for that purpose: it aggregates browsing history from different browsers and presents it in a unified timeline-style view, which supports rapid triage and cross-validation of user activity. By contrast, MZHistoryView and MZCacheView are associated with Mozilla-family artifacts (history and cache), making them appropriate for Firefox-related examinations rather than Edge. ChromeHistoryView is specialized for Google Chrome history databases and does not target Edge artifacts as its primary source. In forensic workflow terms, a multi-browser history tool is valuable because it helps identify patterns such as repeated access to specific domains, time windows of browsing activity, and correlation with other Windows artifacts (prefetch, jump lists,