Question 1

Disk editors list all files on the suspect drive after the recovery of erased, deleted, hidden, and compressed files.

Accepted Answer

A) True 
 B)False  True

Question 2

According to popular science Web sites, the scientific process of digital forensics normally starts with a(n) ________.

Accepted Answer

A)  experiment 
B)  question 
C)  probable answer 
D)  possible solution 
A)  experiment 
B)  question 
C)  probable answer 
D)  possible solution B

Question 3

Which of the following can NOT be categorized as file viewer software?

Accepted Answer

A)  Conversions Plus 
B)  CompuPic 
C)  DiskEdit 
D)  Thumbs Plus 
A)  Conversions Plus 
B)  CompuPic 
C)  DiskEdit 
D)  Thumbs Plus C

Question 4

According to popular science Web sites, the process of digital forensics normally starts with a hypothesis that forms into a question.

Accepted Answer

A) True 
 B)False

Question 5

Discuss forensic investigation in non-Window operating systems.

Accepted Answer

Forensic investigation in non-Windows op

Question 6

In its most basic form, ________ refers to the process of converting a message from its original form ("plaintext") into an indecipherable or scrambled form ("ciphertext").

Accepted Answer

The answer of In its most basic form, ________ refers...

Question 7

Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?

Accepted Answer

A)  New floppy drives bear the danger of being virus carriers. 
B)  A previously verified forensic floppy can detect anomalies in the drive faster. 
C)  Some users will configure their system to erase/modify data if third-party access is determined. 
D)  The verified forensic floppy can disable the write-blocking program found on most original media. 
A)  New floppy drives bear the danger of being virus carriers. 
B)  A previously verified forensic floppy can detect anomalies in the drive faster. 
C)  Some users will configure their system to erase/modify data if third-party access is determined. 
D)  The verified forensic floppy can disable the write-blocking program found on most original media.

Question 8

Which rule remains unchanged in every computer investigation?

Accepted Answer

A)  encrypt all notes 
B)  search every single file 
C)  pull the battery 
D)  document 
A)  encrypt all notes 
B)  search every single file 
C)  pull the battery 
D)  document

Question 9

Which are the most common places in a suspect computer where traces of evidence from Internet activity can be found?

Accepted Answer

In the context of digital forensics, whe

Question 10

Which of the following is NOT a cell phone forensics software?

Accepted Answer

A)  Device Seizure 
B)  UFED 
C)  XRY Complete 
D)  Grep 
A)  Device Seizure 
B)  UFED 
C)  XRY Complete 
D)  Grep

Question 11

Investigators should validate any forensic software to be used by testing it at the ________ and familiarizing themselves with its capabilities.

Accepted Answer

The answer of Investigators should validate any forensic software to...

Question 12

Which of the following is NOT an advantage of the creation of images on forensic machines?

Accepted Answer

A)  revealing any passwords used in operating systems 
B)  preserving the integrity of the original image 
C)  preventing data contamination 
D)  establishing the veracity of subsequent analysis 
A)  revealing any passwords used in operating systems 
B)  preserving the integrity of the original image 
C)  preventing data contamination 
D)  establishing the veracity of subsequent analysis

Question 13

Which of the following is the unique identifier assigned to network interfaces for communications on the physical network segment?

Accepted Answer

A)  DNS 
B)  MAC Address 
C)  Traceroute 
D)  IP address 
A)  DNS 
B)  MAC Address 
C)  Traceroute 
D)  IP address

Question 14

What does "establish forensically sterile conditions" mean in the context of computer-crime investigation?

Accepted Answer

A)  Maintain secrecy about the developments at the forensic lab. 
B)  Ensure that the members of the staff have no criminal history. 
C)  Keep the room for forensic tests clean and hygienic. 
D)  Use new media that have been forensically wiped. 
A)  Maintain secrecy about the developments at the forensic lab. 
B)  Ensure that the members of the staff have no criminal history. 
C)  Keep the room for forensic tests clean and hygienic. 
D)  Use new media that have been forensically wiped.

Question 15

________ are designed to be the first line of defense for users, thus preventing individuals from booting the computer's operating system.

Accepted Answer

A)  Software passwords 
B)  BIOS passwords 
C)  CMOS passwords 
D)  Document passwords 
A)  Software passwords 
B)  BIOS passwords 
C)  CMOS passwords 
D)  Document passwords

Question 16

Which of the following is the most time-consuming method of circumventing CMOS passwords?

Accepted Answer

A)  key disks 
B)  default passwords 
C)  social engineering 
D)  jumping 
A)  key disks 
B)  default passwords 
C)  social engineering 
D)  jumping

Question 17

Program files are software applications that are installed in the computer.

Accepted Answer

A) True 
 B)False

Question 18

The ________ for a computer is the unique identifier assigned to network interfaces for communications on the physical network segment.

Accepted Answer

MAC (Media

Question 19

________ the CMOS involves the manipulation of hardware in which the password is cleared after the jumper has been reset.

Accepted Answer

The answer of ________ the CMOS involves the manipulation of...

Question 20

Traceroute is a tool designed to trace the path a packet takes upon traveling from one device to another.

Accepted Answer

A) True 
 B)False

Disk editors list all files on the suspect drive after the recovery of erased, deleted, hidden, and compressed files.

According to popular science Web sites, the scientific process of digital forensics normally starts with a(n) ________.

Which of the following can NOT be categorized as file viewer software?

According to popular science Web sites, the process of digital forensics normally starts with a hypothesis that forms into a question.

Discuss forensic investigation in non-Window operating systems.

In its most basic form, ________ refers to the process of converting a message from its original form ("plaintext") into an indecipherable or scrambled form ("ciphertext").

Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?

Which rule remains unchanged in every computer investigation?

Which are the most common places in a suspect computer where traces of evidence from Internet activity can be found?

Which of the following is NOT a cell phone forensics software?

Investigators should validate any forensic software to be used by testing it at the ________ and familiarizing themselves with its capabilities.

Which of the following is NOT an advantage of the creation of images on forensic machines?

Which of the following is the unique identifier assigned to network interfaces for communications on the physical network segment?

What does "establish forensically sterile conditions" mean in the context of computer-crime investigation?

________ are designed to be the first line of defense for users, thus preventing individuals from booting the computer's operating system.

Which of the following is the most time-consuming method of circumventing CMOS passwords?

Program files are software applications that are installed in the computer.

The ________ for a computer is the unique identifier assigned to network interfaces for communications on the physical network segment.

________ the CMOS involves the manipulation of hardware in which the password is cleared after the jumper has been reset.

Traceroute is a tool designed to trace the path a packet takes upon traveling from one device to another.

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Computer Forensics: Terminology and Requirements

Searching and Seizing Computer-Related Evidence

Conclusions and Future Issues

Filters

Exam 12: Processing of Evidence and Report Preparation

Disk editors list all files on the suspect drive after the recovery of erased, deleted, hidden, and compressed files.

According to popular science Web sites, the scientific process of digital forensics normally starts with a(n) ________.

Which of the following can NOT be categorized as file viewer software?

According to popular science Web sites, the process of digital forensics normally starts with a hypothesis that forms into a question.

Discuss forensic investigation in non-Window operating systems.

In its most basic form, ________ refers to the process of converting a message from its original form ("plaintext") into an indecipherable or scrambled form ("ciphertext").

Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?

Which rule remains unchanged in every computer investigation?

Which are the most common places in a suspect computer where traces of evidence from Internet activity can be found?

Which of the following is NOT a cell phone forensics software?

Investigators should validate any forensic software to be used by testing it at the ________ and familiarizing themselves with its capabilities.

Which of the following is NOT an advantage of the creation of images on forensic machines?

Which of the following is the unique identifier assigned to network interfaces for communications on the physical network segment?

What does "establish forensically sterile conditions" mean in the context of computer-crime investigation?

________ are designed to be the first line of defense for users, thus preventing individuals from booting the computer's operating system.

Which of the following is the most time-consuming method of circumventing CMOS passwords?

Program files are software applications that are installed in the computer.

The ________ for a computer is the unique identifier assigned to network interfaces for communications on the physical network segment.

________ the CMOS involves the manipulation of hardware in which the password is cleared after the jumper has been reset.

Traceroute is a tool designed to trace the path a packet takes upon traveling from one device to another.

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Computer Forensics: Terminology and Requirements

Searching and Seizing Computer-Related Evidence

Conclusions and Future Issues

Filters