Exam 2 Digital Forensics

¡Supera tus tareas y exámenes ahora con Quizwiz!

Which of the listed date/time stamps is updated whenever a file is accessed by the file system? Created Modified Accessed None of the Above

Accessed

Which of the following are forensic image formats .E01 .001 .AD1 All of the Above

All of the Above

Which of the following are possible solutions with protecting cell phones from network signals? Aluminum Foil Paint Can Faraday Bag All of the Above

All of the Above

Which of the following element(s) ensure valid and reliable results are produced and justice is served in all types of lab setups? Standard Operating Procedures & Quality of Assurance Accreditation & Certification All of the Above None of the Above

All of the Above

Which of the following meets a series of strict legal requirements before evidence is presented in court? Chain of Logs Chain of Custody Notes All of the Above

Chain of Custody

Legal authority can be negotiated before taking a computer off-premises in: Criminal Cases Civil Cases All of the Above None of the Above

Civil Cases

Which of the listed date/time stamps frequently indicates when a file or folder was created on a particular piece of media? Created Modified Accessed None of the Above

Created

Which of the following represents an image of a document to be printed? SHA-1 MD5 EMF ROM

EMF

A tool validation process clearly demonstrates that the tool is licensed

False

According to the author any writes to the evidence will not comprise it's integrity and/or jeopardize it's admissibility

False

According to the author interacting with a running computer, in any way, will not cause changes to the system

False

According to the author, a forensic clone is a backup copy of a hard drive

False

Active data is classified as deleted or partially overwritten.

False

Improving the quality of lab services provided to the social media system is an objective of ASCLD/LAB

False

Sectors are comprised of multiple clusters

False

The File Allocation Table (FAT) can be expressed as FATX, FAT32, NTFS, FAT16, and FAT12

False

The NTUSER.DAT file is located in the subfolder config

False

The Windows operating system can see data in unallocated space

False

The registry consist of both NTUSER.DAT and the five (5) root-level keys or hives

False

There are 512 bits in each sector

False

Which of the following week out a charge will read a zero? Magnetic Disks and Flash Memory Magnetic Disks Flash Memory Optical Storage All of the Above None of the Above

Flash Memory

Which of the following, in the examiners report, can assist out intended audience wade through any unfamiliar jargon and acronyms? Forms Notes Glossary All of the Above

Glossary

Which of the following is where we start to see some potential investigative benefit? Sleep Hibernation Sleep and Hibernation None of the Above

Hibernation

Which of the following test is conducted by the agency? Output Input External Internal

Internal

According to the author, the most common hash functions used in digital forensics are: CRC SJA2 SJA1 MD5

MD5

Which of the listed date/time stamps are set when a file is altered in any way and then saved? Created Modified Accessed None of the Above

Modified

Which of the following has launched the Computer Forensic Tool Testing Project (CFTT)? HWB NIST NIJ none of the above

NIST

Which of the following applies when the analyst is aware of being tested? External Oral Open Closed

Open

Which of the storage items/terms below involves spaces or lands? Magnetic Disks and Flash Memory Magnetic Disks Flash Memory Optical Storage All of the Above None of the Above

Optical Storage

Which of the following is not a type of quality assurance proficiency tests? Oral External Internal Blind

Oral

The first "link" in the chain of custody is: Person Recording the Evidence Person Receiving the Evidence Person Collection the Evidence All of the Above

Person Collecting the Evidence

Which of the following plays a crucial role in the operation of a PC? Sleep Hibernation Sleep and Registry Registry

Registry

The shadow copies provide the source data for _____ Registry Files Link Files Prefetch Files Restore Points All of the Above None of the Above

Restore Points

Which of the following are snapshots of key system settings and configurations at a specific moment in time? Registry Files Link Files Prefetch Files Restore Points All of the Above None of the Above

Restore Points

The virtual lab arrangement allows for a distinct _____ access Role-Playing Proprietary-Role Fundamental-Role Role-Based

Role-Based

Which of the following are the most volatile evidence to collect first? Routing Table and ARP Cache Temporary Files System and Swap Space Remotely Logged Data Data on the Hard Drive

Routing Table and ARP Cache

A bitstream or forensic image is required to collect latent data

True

A computer's operating system only stores data as clusters.

True

A forensic examination may be conducted on the original evidence in exigent circumstances

True

RAM stores all the data currently being worked on by the Central Processing Unit (CPU)

True

The tool validation process is an aspect of our digital forensics that is committed to paper

True


Conjuntos de estudio relacionados

Clinical Decision Making, Communication, Evidence-Based Practice NUR 111 Study Guide Test 1

View Set

PET VOCABULARY LIST A-P ENGLISH-SPANISH TCEC Linares

View Set

What is Child life / AAP Statement / ACCH Research Study

View Set

Principles of Management Test Chapters 9-12

View Set

Life Insurance CH.5 (New Jersey Laws, Rules, and Regulations Common to All Lines)

View Set

1 Premature Death Loss Exposures

View Set

CH 1 - The Corporation and Its Stakeholders

View Set

LS 7C Midterm 1 Learning Objectives

View Set