Digital Media Forensics - Cengage/MIndTap Labs

What type of forensic copy should be conducted on the original media? Packet-stream Byte-stream File-system copy Bit-stream

Bit-stream

What is the term for tracking evidence in an investigation? Chain of custody Evidence control and tracking Chain of evidence Sequence of custody

Chain of custody

Of the following choices, which would permanently remove data from media so that it is unrecoverable? Data is no longer accessible once it is deleted Reformatting the hard drive is the only way to fully delete data Data is accessible until it is overwritten by other content to the same physical location You must empty the recycle bin to permanently delete data

Data is accessible until it is overwritten by other content to the same physical location

What Amendment to the U.S. Constitution provides protection against unlawful searches and seizures? Fifth Amendment Third Amendment Sixth Amendment Fourth Amendment

Fourth Amendment

What is the first rule of digital forensics and subsequent analysis of evidence? Store and analyse original evidence only Preserve the original evidence, and analyse a copy only Make a copy of the evidence, but analyse the original only It doesn't matter what copy you use as long as there is a duplicate copy

Preserve the original evidence, and analyse a copy only