A suspect is accused of violating the acceptable use of computing resources as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded.
What can the investigator do to prove the violation? Choose the most feasible option.

When collecting evidence from the RAM, where do you look for data?

On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are normally allocated to this file?