Question 1

Which of the following defines artifacts?

Accepted Answer

A)  temporary data files that were created by applications 
B)  data files that pertain to or were created by an individual user 
C)  system-generated files that are created for operational purposes 
D)  files that pertain to Internet history and e-mail 
A)  temporary data files that were created by applications 
B)  data files that pertain to or were created by an individual user 
C)  system-generated files that are created for operational purposes 
D)  files that pertain to Internet history and e-mail

Question 2

________, located either by the BIOS or elsewhere on the motherboard, are utilized to bypass protections found in the CMOS.

Accepted Answer

A)  Artifacts 
B)  Key disks 
C)  Steganographic containers 
D)  Jumpers 
A)  Artifacts 
B)  Key disks 
C)  Steganographic containers 
D)  Jumpers

Question 3

Testing forensic software at the extremes and becoming familiar with its capabilities is ________.

Accepted Answer

A)  unnecessary if manufacturers provide documentation 
B)  a way to validate the forensic software 
C)  not recommended due to the danger of acquiring viruses 
D)  more common among computer criminals than investigators 
A)  unnecessary if manufacturers provide documentation 
B)  a way to validate the forensic software 
C)  not recommended due to the danger of acquiring viruses 
D)  more common among computer criminals than investigators

Question 4

Some computers allow a BIOS bypass by inserting a ________ in the floppy disk drive while booting.

Accepted Answer

The answer of Some computers allow a BIOS bypass by...

Question 5

Which of the following is a tool that can query a database that includes domain names, IP addresses, and points of contact, including names, postal addresses, and telephone numbers?

Accepted Answer

A)  whois 
B)  ARIN 
C)  Back Orifice 
D)  RIPE 
A)  whois 
B)  ARIN 
C)  Back Orifice 
D)  RIPE

Question 6

In the context of computer forensics, which of the following is NOT required as minimum documentation?

Accepted Answer

A)  physical description of media 
B)  time, date, and place of analysis 
C)  methodology employed 
D)  a list of standardized defaults for password location 
A)  physical description of media 
B)  time, date, and place of analysis 
C)  methodology employed 
D)  a list of standardized defaults for password location

Question 7

In a rare case where investigators cannot remove a suspect drive, they may be confounded by the presence of a ________.

Accepted Answer

The answer of In a rare case where investigators cannot...

Question 8

________ is a mechanism that prevents the destruction, contamination, or corruption of original media and that can be accomplished with many of the popular imaging programs, disk management software, or simple DOS commands.

Accepted Answer

A)  Jumping 
B)  AUTOEXEC.BAT 
C)  CONFIG.SYS 
D)  Write-blocking 
A)  Jumping 
B)  AUTOEXEC.BAT 
C)  CONFIG.SYS 
D)  Write-blocking

Question 9

Short-circuiting the chip often involves short-circuiting two pins of the BIOS chip for a few seconds.

Accepted Answer

A) True 
 B)False

Question 10

Licenses for forensic software that is expected to be employed in the analysis of suspect media are not required.

Accepted Answer

A) True 
 B)False

Question 11

Discuss some of the ways to recover passwords.Why do you think they are important to forensic investigation?

Accepted Answer

There are several ways to recover passwo

Question 12

In a suspect Linux/Unix machine, the /etc/passwd file contains all the following EXCEPT ________.

Accepted Answer

A)  account ID 
B)  home directory 
C)  local domain name system entries 
D)  login shell 
A)  account ID 
B)  home directory 
C)  local domain name system entries 
D)  login shell

Question 13

Which of the following makes digital forensics a science?

Accepted Answer

A)  Its processes are repeatable and proven. 
B)  It analyzes various computer programs in order to arrive at assumptions. 
C)  It follows a universal, standard procedure. 
D)  It is a universally accepted discipline in universities. 
A)  Its processes are repeatable and proven. 
B)  It analyzes various computer programs in order to arrive at assumptions. 
C)  It follows a universal, standard procedure. 
D)  It is a universally accepted discipline in universities.

Question 14

Match between columns
                        Premises: Conversions Plus
Quick View Plus
Thumbs Plus

Accepted Answer

The Answer of allows users to access, view, and print is...

Question 15

Match between columns
                        Premises: System registry
Log files
Swap tiles

Accepted Answer

The Answer of files which record and document any significant is...

Question 16

________ contains the precise location of the satellite and the locations of all other satellites in the system.

Accepted Answer

The answer of ________ contains the precise location of the...

Question 17

Linux systems are different in that they are characterized by a unified file system on three partitions: root, boot, and swap.

Accepted Answer

A) True 
 B)False

Question 18

All media used in the analysis of computer evidence must be forensically ________ for courtroom purposes.

Accepted Answer

The answer of All media used in the analysis of...

Question 19

The MAC address is a binary number made up of four octets or 32 bits.

Accepted Answer

A) True 
 B)False

Question 20

Batch files provide a platform of consistency that validates their procedures to the court.

Accepted Answer

A) True 
 B)False

Which of the following defines artifacts?

________, located either by the BIOS or elsewhere on the motherboard, are utilized to bypass protections found in the CMOS.

Testing forensic software at the extremes and becoming familiar with its capabilities is ________.

Some computers allow a BIOS bypass by inserting a ________ in the floppy disk drive while booting.

Which of the following is a tool that can query a database that includes domain names, IP addresses, and points of contact, including names, postal addresses, and telephone numbers?

In the context of computer forensics, which of the following is NOT required as minimum documentation?

In a rare case where investigators cannot remove a suspect drive, they may be confounded by the presence of a ________.

________ is a mechanism that prevents the destruction, contamination, or corruption of original media and that can be accomplished with many of the popular imaging programs, disk management software, or simple DOS commands.

Short-circuiting the chip often involves short-circuiting two pins of the BIOS chip for a few seconds.

Licenses for forensic software that is expected to be employed in the analysis of suspect media are not required.

Discuss some of the ways to recover passwords.Why do you think they are important to forensic investigation?

In a suspect Linux/Unix machine, the /etc/passwd file contains all the following EXCEPT ________.

Which of the following makes digital forensics a science?

________ contains the precise location of the satellite and the locations of all other satellites in the system.

Linux systems are different in that they are characterized by a unified file system on three partitions: root, boot, and swap.

All media used in the analysis of computer evidence must be forensically ________ for courtroom purposes.

The MAC address is a binary number made up of four octets or 32 bits.

Batch files provide a platform of consistency that validates their procedures to the court.

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Computer Forensics: Terminology and Requirements

Searching and Seizing Computer-Related Evidence

Conclusions and Future Issues

Filters

Exam 12: Processing of Evidence and Report Preparation

Which of the following defines artifacts?

________, located either by the BIOS or elsewhere on the motherboard, are utilized to bypass protections found in the CMOS.

Testing forensic software at the extremes and becoming familiar with its capabilities is ________.

Some computers allow a BIOS bypass by inserting a ________ in the floppy disk drive while booting.

Which of the following is a tool that can query a database that includes domain names, IP addresses, and points of contact, including names, postal addresses, and telephone numbers?

In the context of computer forensics, which of the following is NOT required as minimum documentation?

In a rare case where investigators cannot remove a suspect drive, they may be confounded by the presence of a ________.

________ is a mechanism that prevents the destruction, contamination, or corruption of original media and that can be accomplished with many of the popular imaging programs, disk management software, or simple DOS commands.

Short-circuiting the chip often involves short-circuiting two pins of the BIOS chip for a few seconds.

Licenses for forensic software that is expected to be employed in the analysis of suspect media are not required.

Discuss some of the ways to recover passwords.Why do you think they are important to forensic investigation?

In a suspect Linux/Unix machine, the /etc/passwd file contains all the following EXCEPT ________.

Which of the following makes digital forensics a science?

________ contains the precise location of the satellite and the locations of all other satellites in the system.

Linux systems are different in that they are characterized by a unified file system on three partitions: root, boot, and swap.

All media used in the analysis of computer evidence must be forensically ________ for courtroom purposes.

The MAC address is a binary number made up of four octets or 32 bits.

Batch files provide a platform of consistency that validates their procedures to the court.

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Computer Forensics: Terminology and Requirements

Searching and Seizing Computer-Related Evidence

Conclusions and Future Issues

Filters