Chapter 01: Understanding the Digital Forensics Profession and Investigation
Computer investigations and forensics fall into the same category: public investigation.
False
When you work in the enterprise digital group, you test and verify and integrity of standalone workstations and network servers.
False
_____ often work as part of a team to secure an organization's computers and networks.
Forensics investigators
By the early 1990s, the ____ introduced training on software for forensic investigations.
IACIS
Corporations often follow the _____ doctrine, which is what happens when a civilian or corporate investigative agent delivers evidence to a law enforcement officer.
silver-platter
The FBI _____ was formed in 1984 to handle the increasing number of cases involving digital evidence.
Computer Analysis and Response Team (CART)
List each piece of evidence on a separate page
Single - evidence form
The affidavit must be _____ under sworn oath to verify that the information in the affidavit is true.
notarized
Sworm statement of support of facts about or evidence of a crime that is submitted to a judge to request a search warrant before sizing evidence
Affidavit
A person who has the power to initiate investigations in a corporate environment
Authorized requester
In the Pacific Northwest, _____ meets to discuss problems that digital forensic examiners encounter.
CTIN
Allows legal counsel to use previous cases similar to the current one because the law don't yet exist
Case law
_____ involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.
Data recovery
The application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a straight chain of custody for the data
Digital forensics
Maintaining credibility means you must form and sustain unbiased opinion of your cases.
False
The law of search and seizure protects the right of all people, excluding people suspected of crimes.
False
Involves selling sensitive or confidential company information to a competitor
Industrial espionage
Specifies who has the legal right to initiate an investigation, who can take profession of evidence, and who can have access to evidence
Line of authority
Yields information about how attackers gain access to a network along with files they might have copied, examined, or tampered with
Network forensics
After a judge approves and signs a search warrant, it's ready to be executed, meaning you can collect evidence as defined by the warrant.
True
By 1970s, electronic crimes were increasing, especially in the financial sector.
True
The Fourth Amendment to the U.S. Constitution (and each state's constitution) protects everyone's right to be secure in their persons, residence, and property from search and seizure.
True
The definition of a digital forensics has evolved over the years from simply involving securing and analyzing digital information stored on a computer for use as evidence in civil, criminal, or administrative cases.
True
The police blotter provides a record of clues to crimes that have been committed previously.
True
To be a successful computer forensic investigator, you must be familiar with more than one Computing platform.
True
Based on the incident or crime, the complainant makes a(n) _____, an accusation or supposition of fact that a crime has been committed.
allegation
In addition to warning banners that state a company's right of computer ownership, businesses should specify a(n) _____ who has the power to conduct investigations.
authorized requester
In a case, ____ a suspect is charged for a criminal offense, such as burglary, murder, or molestation.
criminal
The ____ group manages investigations and conduct forensics analysis of system suspected of containing evidence related to an incident or a crime.
digital investigations
A(n) _____ is a person using a computer to perform routine tasks other than system administration.
end user
It's the investigator's responsibility to write the affidavit, which must include _____ (evidence) that support the allegation to justify the warrant.
exhibits
The process of trying to get a suspect to confess to a specific incident or crime
interrogation
Published company policies provide a(n) _____ for a business to conduct Internal investigations.
line of authority
Most digital investigations in the private sector involve _____.
misuse of digital assets
Without a warning banner, employees might have an assumed _____ when using a company's computer systems and network accesses.
right of privacy
A _____ usually appears when a computer start or connect to the company intranet, network, or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer system and network traffic at will.
warning banner
Recognized file types and retrieve lost or deleted files
Xtree Gold
In a criminal or public case, if you have enough information to support a search warrant, the prosecuting attorney must direct you to submit a(n) _____.
affidavit
Your _____ as a digital investigation and forensics analyst is a critical because it determines your credibility.
professional conduct
In general, a criminal case follows three stages: the complaint, the investigation, and the _____.
prosecution