Exam 12: Processing of Evidence and Report Preparation

Whois is a tool which can query a database that includes domain names, IP addresses, and points of contact.

What would enable investigators to establish a step-by-step preliminary investigative process which runs programs in a specified order?

When investigators pull the CMOS battery to circumvent a password, the battery should be disconnected for at least ________ hours.

Which of the following refers to a category of software that allows users to effectively hide the content of selected files?

The most important aspect of data analysis is ________.

The Net Section of an IP address may be used to identify the individual computer.

Steganographic messages have two parts: the container, which is the file that conceals data, and the ________, which is the actual data.

What is the minimum number of imaging programs that any forensic labs should be equipped with?

According to the Association of Chief Police Officers, which of the following is NOT a part of computer forensics?

Unlike other types of passwords which may be defeated using traditional password cracking software, CMOS passwords often require hardware manipulation on the part of the investigator.

On Windows systems, ________ are system-generated files created for operational purposes.

How long should the CMOS battery be kept disconnected for the memory to be lost?

What are the areas that should be documented in a forensic investigation? What, in your opinion, makes documentation the most important aspect of forensic science?

________ is a software application designed for Windows-based systems which provides extraction and analysis tools for a multitude of devices, including smartphones and tablets.

In which of the following techniques do the investigators try to develop a profile of the suspect or the suspect computer and manually attempt password cracking?

Jumping the CMOS involves the manipulation of software in which the password is cleared after the jumper has been reset.

Investigators validate forensic software to be used by testing the software at the extremes and being familiarized with its capabilities.

________ may be created to incorporate all of the forensic software employed, including write-blocking, imaging and verification, disk management, and virus scan.

Which of the following programs can be employed by an investigating officer to counter alteration of file extensions?