Chapter 1 Quiz - Cengage / Sammons
c. Digital Evidence First Responder
After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant. a. Digital Evidence Scene Investigator b. Digital Evidence Specialist c. Digital Evidence First Responder d. Digital Evidence Recorder
False
Digital forensics and data recovery refer to the same activities. True False
True
For digital evidence, an evidence bag is typically made of antistatic material. True False
d. affidavit
If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______. a. memo b. verdict c. exhibit d. affidavit
A. DOMEX
In Afghanistan and Iraq, armed forces are exploiting intelligence collected from digital devices brought straight from the battlefield The process is known as A. DOMEX B. NICE C. AAFS D. Quality Assurance
True
In a legal sense, to be considered an expert in a court of law, one doesn't have to possess an advanced academic degree. True False
Fourth Amendment
Police in the United States must use procedures that adhere to which of the following? Third Amendment Fourth Amendment First Amendment None of the above
a. civil suit
The _______ is not one of the three stages of a typical criminal case. a. civil suit b. complaint c. investigation d. prosecution
True
User groups for a specific type of system can be very useful in a forensics investigation. True False
Chain of custody
What do you call a list of people who have had physical possession of the evidence? Chain of custody Affidavit Evidence record Evidence log
Signature of an impartial judicial officer
What is one of the necessary components of a search warrant? Signature of an impartial judicial officer Professional codes Standards of behavior Professional ethics
False
A warning banner should never state that the organization has the right to monitor what users do. True False
True
Embezzlement is a type of digital investigation typically conducted in a business environment. True False
False
In a civil case, both parties are generally entitled to examine the evidence that will be used against them before trial. This legal process is known as "scientific method." True False
D. Examination of the file's metadata
In the case of Dennis Rader better known as the BTK Killer, investigators got the lead they needed to arrest and seal the suspect's fate through A. Document and Media Exploitation (DOMEX) B. Identifying which websites had been visited C. Locating what applications had been installed or uninstalled D. Examination of the file's metadata
True
One way to determine the resources needed for an investigation is based on the OS of the suspect computer, list the software needed for the examination. True False
Any of the above
Policies can address rules for which of the following? The amount of personal e-mail you can send The Internet sites you can or can't access When you can log on to a company network from home Any of the above
A. Imaging/hashing, Repeatability, Analysis, Reporting
Put these phases of a digital forensic process in the proper order (not all phases represented. A. Imaging/hashing, Repeatability, Analysis, Reporting B. Expert Presentation, Search Authority, Analysis, C of C C. Reporting, Analysis, Imaging, Search Authority D. Repeatability, Hashing, Search Authority, Expert Presentation
B. The WTCC Computer Technologies Department
Several organizations help establish the standards and best practices used in digital forensics. These organizations include all of the following except A. The American Academy of Forensic Sciences B. The WTCC Computer Technologies Department C. Scientific Working Group on Digital Evidence D. American Society for Testing Materials
b. Federal Rules of Evidence
Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings. a. Federal Proceedings Law b. Federal Rules of Evidence c. Federal Proceedings Rules d. Federal Consistency Standards
C. Digital Forensics
The application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, and possible expert presentation is the definition of A. Electronic Discovery B. Imaging/Hashing C. Digital Forensics D. Search Authority
False
The name given to the mathematical process (via an algorithm) that produces a unique value that is essentially the digital "fingerprint" of a particular file is known as bitstream imaging. True False
B. Locard's Exchange Principle
The principle that says, in the physical world, whenever perpetrators enter of leave a crime scene, they will leave something behind and take something with them is A. File Carving B. Locard's Exchange Principle C. Principles of Live Collection D. Data Persistence
True
The purpose of maintaining a network of digital forensics specialists is to develop a list of colleagues who specialize in areas different from your own specialties in case you need help on an investigation. True False
b. industrial espionage
The sale of sensitive or confidential company information to a competitor is known as _______. a. industrial betrayal b. industrial espionage c. industrial sabotage d. industrial collusion
Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation
The triad of computing security includes which of the following? Vulnerability assessment, intrusion response, and monitoring Detection, response, and monitoring Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation Vulnerability assessment, detection, and monitoring
B. Electronic discovery
This term refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. A. Repeatability B. Electronic discovery C. Chain of Custody D. Locard's exchange principle
c. ILook
What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk? a. DeepScan b. Photorec c. ILook d. AccessData Forensic Toolkit
To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant
What's the purpose of an affidavit? To list problems that might happen when conducting an investigation To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant To determine the OS of the suspect computer and list the software needed for the examination To specify who, what, when, and where—that is, specifics on place, time, items being searched for, and so forth
c. MS-DOS 6.22
Which Microsoft OS below is the least intrusive to disks in terms of changing data? a. Windows XP b. Windows 95 c. MS-DOS 6.22 d. Windows 7
To make sure data isn't altered
Why should evidence media be write-protected? To make image files smaller in size To speed up the imaging process To make sure data isn't altered To comply with Industry standards
To improve your work
Why should you critique your case after it's finished? To maintain a professional conduct To list problems that might happen when conducting an investigation To improve your work To maintain chain of custody
To list problems that might happen when conducting an investigation
Why should you do a standard risk assessment to prepare for an investigation? To list problems that might happen when conducting an investigation To obtain a search warrant To obtain an affidavit To discuss the case with the opposing counsel
b. repeatable findings
Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______. a. reloadable steps b. repeatable findings c. verifiable reporting d. evidence reporting
False
You should always prove the allegations made by the person who hired you. True False
False
You shouldn't include a narrative of what steps you took in your case report True False
a. Exhibits
_______ must be included in an affidavit to support an allegation in order to justify a warrant. a. Exhibits b. Subpoenas c. Witnesses d. Verdicts
