Forensics and Security Ch. 11,14,15,16
Which of the following types of files can provide useful information when you're examining an e-mail server?
.log files
All expert witnesses must be members of associations that license them.
False
Phishing does which of the following?
Lures users with false promises
In the United States, no state or national licensing body specifically licenses forensics examiners.
True
Before testifying, you should do which of the following?
a: Create an examination plan with your retaining attorney. b: Make sure you've been paid for your services and the estimated fee for the deposition or trial. Both a and b
Logging options on e-mail servers can be which of the following?
c: Configured to a specified size before being overwritten
Sendmail uses which file for instructions on processing an e-mail message?
sendmail.cf
On a UNIX-like system, which file specifies where to save different types of e-mail log files?
syslog.conf
List three obvious ethical errors.
* Don't present false data or alter data. * Don't report work that was not done. * Don't ignore available contradictory data. * Don't accept an assignment if it cannot reasonably be done in the allowed time. * Don't reach a conclusion before you have done complete research. * Don't fail to report possible conflicts of interest. * Don't ignore available contradictory data. * Don't do work beyond your expertise or competence. * Don't allow the attorney who retained you to influence your opinion in an unauthorized way. *All of the above
In Microsoft Outlook, e-mails are typically stored in which of the following?
.pst and .ost files
To trace an IP address in an e-mail header, what type of lookup service can you use?
A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net
Your curriculum vitae is which of the following?
A generally required document to be made available before your testimony A detailed record of your experience, education, and training A necessary tool to be an expert witness All of the above
What is a motion in limine?
A pretrial motion for the purpose of excluding certain evidence
E-mail headers contain which of the following information?
An ESMTP number or reference number The sender and receiver e-mail addresses The e-mail servers the message traveled through to reach its destination All of the above
Which of the following is an example of a written report?
An affidavit
What information is not in an e-mail header?
Blind copy (bcc) addresses
When working for a prosecutor, what should you do if the evidence you found appears to be exculpatory and isn't being released to the defense?
Bring the information to the attention of the prosecutor, then his or her supervisor, and finally to the judge (the court).
When you access your e-mail, what type of computer architecture are you using?
Client/server
When writing a report, what's the most important aspect of formatting?
Consistency
Automated tools help you collect and report evidence, but you're responsible for doing which of the following?
Explaining the significance of the evidence
A forensic linguist can determine an author's gender by analyzing chat logs and social media communications.
False
Codes of professional conduct or responsibility set the highest standards for professionals' expected performance.
False
Ethical obligations are duties that you owe only to others.
False
Even in the light of recent developments in technology, you shouldn't change your opinion from one you testified to in a previous case.
False
Figures not used in the body of the report can't be included in report appendixes
False
You can view e-mail headers in Notepad with all popular e-mail clients.
False
What purpose does making your own recording during a deposition serve?
It allows you to review your testimony with your attorney during breaks.
Which of the following statements about the legal-sequential numbering system in report writing is true?
It doesn't indicate the relative importance of information.
Externally enforced ethical rules, with sanctions that can restrict a professional's practice, are more accurately described as which of the following?
Laws
Which of the following is a current formatting standard for e-mail?
MIME
During your cross-examination, you should do which of the following?
Maintain eye contact with the jury. Help the attorneys, judge, and jury in understanding the case, even if you have to go a bit beyond the scope of your expertise. Pay close attention to opposing counsel's questions. All of the above
What's the main piece of information you look for in an e-mail message you're investigating?
Originating e-mail domain or IP address
Which of the following is the standard format for reports filed electronically in U.S. federal courts and most state courts?
The most reliable way to ensure that jurors recall testimony is to do which of the following?
Present evidence combining oral testimony and graphics that support the testimony.
When you begin a conversation with an attorney about a specific case, what should you do?
Refuse to discuss details until a retainer agreement is returned.
When confronted with an e-mail server that no longer contains a log with the date information you need for your investigation, and the client has deleted the e-mail, what should you do?
Restore the e-mail server from a backup.
Which of the following describes fact testimony?
Scientific or technical testimony describing information recovered during an examination
What expressions are acceptable to use in testimony to respond to a question for which you have no answer?
That's beyond the scope of my investigation. That's beyond the scope of my expertise. I wasn't asked to investigate that. All of the above
What are some risks of using tools you have created yourself?
The tool doesn't generate reports in a standard format.
An expert witness can give an opinion in which of the following situations?
The witness is shown to be qualified as a true expert in the field. The opinion, inferences, or conclusions depend on special knowledge, skills, or training not within the ordinary experience of laypeople. The witness testifies to a reasonable degree of certainty (probability) about his or her opinion, inference, or conclusion. All of the above
For what purpose have hypothetical questions traditionally been used in litigation?
To frame the factual context of rendering an expert witness's opinion
Router logs can be used to verify what types of e-mail data?
Tracking flows through e-mail server ports
After examining e-mail headers to find an e-mail's originating address, investigators use forward lookups to track an e-mail to a suspect.
True
An unethical technique occurs when an opposing counsel might attempt to make discovery depositions physically uncomfortable.
True
Being able to incorporate the log files and reports tools generate into your written reports is a major advantage of automated forensics tools in report writing.
True
E-mail accessed with a Web browser leaves files in temporary folders.
True
If you were a lay witness at a previous trial, you shouldn't list that case in your written report.
True
Spoliation means destroying a report before the final resolution of a case called.
True
Standards that others apply to you or that you're compelled to adhere to by external forces (such as licensing bodies) and your own internal rules you use to measure your performance are two types of ethical standards.
True
Testimony preservation and discovery are two types of depositions.
True
The type of information conveyed to the expert, amount of time involved in discussions or meetings, and whether the expert provided the attorney with confidential information are three factors courts have used in determining whether to disqualify an expert.
True
To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server's internal operations.
True
Voir dire is the process of qualifying a witness as an expert.
True
You should include work experience, training you provided or contributed to, and professional awards or recognitions in your CV.
True
You should take these four steps to handle a deposition in which physical circumstances are uncomfortable: 1. Ask the attorney to correct the situation. 2. If the situation is not corrected, note these conditions into the record, and repeat noting them as long as the conditions persist. 3. After you have noted the problem into the record, you can refuse to continue with the deposition. Generally, you should consult with an attorney before taking this step. 4. If you think the behavior was serious enough that you can justify refusing to continue, consider reporting the attorney to his or her state bar association.
True
If you're giving an answer that you think your attorney should follow up on, what should you do?
Use an agreed-on expression to alert the attorney to follow up on the question.
Contingency fees can be used to compensate an expert under which circumstances?
When the expert is acting only as a consultant, not a witness
At trial as a fact or expert witness, what must you always remember about your testimony?
Your duty is to report your technical or scientific findings or render an honest opinion.
When using graphics while testifying, which of the following guidelines applies?
Your exhibits must be clear and easy to understand. Practice using charts for courtroom testimony. Make sure the jury can see your graphics. All of the above
When searching a victim's computer for a crime committed with a specific e-mail, which of the following provides information for determining the e-mail's originator?
a: E-mail header c: Firewall log Both a and c
Which of the following rules or laws requires an expert to prepare and submit a report?
a: FRCP 26
What kind of information do fact witnesses provide during testimony?
a: Facts only b: Observations of the results of tests they performed Both a and b
List three organizations that have a code of ethics or conduct.
a: ISFCE, IACIS, AMA b: IACIS, APA, ABA Both a and b
What should you do if you realize you have made a mistake or misstatement during a deposition?
a: If the deposition is still in session, refer back to the error and correct it. c: If the deposition is over, make the correction on the corrections page of the copy provided for your signature. Both a and c
Which of the following describes expert witness testimony?
a: Testimony designed to assist the jury in determining matters beyond the ordinary person's scope of knowledge c: Testimony resulting in the expression of an opinion by a witness with scientific, technical, or other professional knowledge or experience Both a and c
