Intro to Digital Forensics
Choose the encoding scheme used for the English language
American Standard Code for Information Interchange (ASCII)
According to the author, which of the following is most volatile when prioritizing the evidence?
CPU
Which of the following meets a series of strict legal requirements before evidence is presented in court.
Chain of custody
Legal authority can be negotiated before taking a computer off-premises in:
Civil Case
Which of the following is not a type of proficiency test?
Dependent
Which of the following are forensic image formats
E01 .001 .AD1
Which of the following represents an image of a document to be printed?
EMF
A file type can always be identified by the file extension.
False
A tool validation process clearly demonstrates that the tool is licensed.
False
According to the author any writes to the evidence will not compromise its integrity and/or jeopardize its admissibility.
False
According to the author interacting with a running computer, in any way, will not cause changes to the system.
False
According to the author, a forensic bag is one way to prevent a network signal from reaching the phone.
False
According to the author, a forensic clone is a backup copy of a hard drive.
False
According to the author, data is generally created in three ways electromagnetism, microscopic electrical transistors (flash), and thumbdrives.
False
Active data is classified as deleted or partially overwritten.
False
Improving the quality of laboratory services provided to the social media system is an objective of ASCLD/LAB.
False
Search Authority is always the final step in any forensic process.
False
The File Allocation Table (FAT) can be expressed as FATX, FAT32, NTFS, FAT16, and FAT12.
False
The NTUSER.DAT file is located in the subfolder config.
False
The best scientific evidence in the world is valuable only if it's inadmissible in a court of law
False
There are 512 bits found in each sector.
False
Which of the following, in the examiners report, can assist our intended audience wade through any unfamiliar jargon and acronyms?
Glossary
Which of the following is where we start to see some potential investigative benefit? in terms of power saving functions
Hibernation
The author describes a process known as Document and Media Exploitation (DOMEX) as paying large dividends and providing _______ to support soldiers on the ground.
Intelligence
Which of the following test is conducted by the agency
Internal
According to the author, the most common hash functions used in digital forensics are
MD5
Which of the following has launched the Computer Forensic Tool Testing Project (CFTT)
NIST
Which of the following applies when the analyst is aware of being tested
Open
Which of the following is not a type of quality assurance proficiency tests?
Oral
The shadow copies provide the source data for ___________.
Restore Points
The virtual lab arrangement allows for a distinct _______ access.
Role-based
Which of the following elements ensures valid and reliable results are produced and justice is served in all types of laboratory setups?
Standard Operating Procedures & Quality of Assurance, Accreditation & Certification
The first "link" in the chain of custody in any case is:
The person collecting the evidence
A forensic examination may be conducted on the original evidence in exigent circumstances.
True
According to the author, JavaScript is a server-side technology.
True
Information is added to the message header from each server along the delivery path of the email message.
True
Internet Message Access Protocol (IMAP) is a two-way communication protocol used by clients to access email on a server.
True
Links files are shortcuts which have a date and time stamps.
True
Metadata is most often defined as data about data.
True
Restore points are snapshots of key system settings and configuration at a specific moment in time.
True
Shadow copies provide the source data for restore points.
True
The browser uses the HTML protocol to send a "get" request to the web server hosting a website.
True
The chain of custody requires tracking each and every time the evidence item(s) changes hands or locations.
True
The operating system of Windows 7 creates a thumbnail cache file called thumbs.db.
True
The registry consist of both NTUSER.DAT and the five (5) root-level keys or hives.
True
The tool validation process is an aspect of our digital forensics that is committed to paper.
True
Which of the listed date/time stamps is updated whenever a file is accessed by the file system?
accessed
Which of the following is the "best" choice when digital evidence can also be valuable for incidents other than litigation and matters of national security.
administrative matters
Which of the following are possible solutions with protecting cell phones from network signals?
aluminum foil. paint can, faraday bag
Which of the following steps involves the examiners use of their skills, experience, and tools to locate and interpret artifacts found on the media?
analysis
A well documented ________ is essential to maintain the integrity of the evidence.
chain of custody
According to the author, what are the advantages of virtual labs?
cost savings access to more tools and storage access to diverse and greater expertise reduction of unnecessary duplication of resources
Which of the listed date/time stamps frequently indicates when a file or folder was created on a particular piece of media?
created
According to the author, the FBI's crime laboratory in Quantico, Virginia, has the distinction of being the _______ forensic lab in the ______.
largest, world
What type of forensic examinations are conducted in the University of Akron High-Technology Forensics Laboratory?
mobile, network, computer, and video
Which of the listed date/time stamps are set when a file is altered in any way and then saved?
modified
Which of the storage items/terms below involves spaces or lands?
optical storage
Which of the following are the most volatile evidence to collect first?
routing table and ARP cache
Which or the following are snapshots of key system settings and configurations at a specific moment in time?
shadow copy
Dennis Rader, known as Bind, Torture, Kill (BTK), murdered:
ten people in Kansas from 1974 to 1991
INDEX.DAT is a binary, container-like file which holds data of value for forensic examiners.
true
The log or audit trail for evidence storage should be maintained with:
who entered when they entered what they removed or what they returned
Which of the following represents the hexadecimal F?
00001111 0x0F 0000-1111 all of the above
Which of the following is equivalent to 0x9C in binary
10011100
Which of the following is equivalent to eight bits and represents one byte?
10101010, 0x4A, 0101-1100, the letter A
The author states, "One of the major struggles in law enforcement is to change the paradigm of the police and get them to think of and seek out _________."
digital evidence
Which of the following is the application of computer science and investigative procedures?
digital forensics
Which of the following creates data written to a platter using a read/write head attached to an actuator arm?
electromagnetism
According to the author, lab security is always a major concern and unauthorized access is the only threat to the evidence, which must be addressed
false
Which of the following without a charge will read a zero?
flash memory
Which of the following is the application of science to solve a legal problem?
forensic science