Chapter 2: Review Questions

List two popular certification programs for digital forensics.

1. CFCE - Certified Forensic Computer Examiner 2. CCFP - Certified Cyber Forensic Professional

What items should your business plan include?

1. Justification 2. Budget - including facility costs, hardware and software requirements, as well as misc. 3. Approval/Acquisition Methods - w/ risk analysis and the number of investigations you plan on pursuing and their average length 4. Implementation - how to incorporate and install all approved items and a timeline for delivery/installation/and inspection of the facility 5. Acceptance Testing - making sure everything works 6. Correction for Acceptance 7. Production

What three items should you research before enlisting in a certification program?

1. Requirements 2. Cost 3. Acceptability in your area of employment

To determine the types of operating systems needed in your lab, list two sources of information you could use.

1. The Uniform Crime Report (UCR) 2. A list of crimes in your area or company

Large digital forensics labs should have at least ______ exits.

2

Which organization has guidelines on how to operate a digital forensics lab?

ANAB (ANSI-ASQ National Accreditation Board)

The ANAB mandates the procedures established for a digital forensics lab. True or False?

False(?)

If a visitor to your digital forensics lab is a personal friend, it's not necessary to have him or her sign the visitor's log. True or False?

False. All visitors must sign the log in order to ensure accountability and security.

A forensic workstation should always have a direct broadband connection to the Internet. True or False?

False. If Internet access is needed, a second, non-Forensic workstation should be used to access the Internet.

Evidence storage containers should have several master keys. True or False?

False. In order to maintain security, the less number of keys available, the better.

Digital forensics facilities always have windows. True or False?

False. They do not have windows in order to protect the privacy and integrity of the investigation.

Which organization provides good information on safe storage containers?

NISPOM (National Industrial Security Program Operating Manual) - Chapter 5, Section 3

Typically, a(n) ______ lab has a separate storage area or room for evidence

Regional

What term refers to labs constructed to shield EMR (electromagnetic radiation) emissions?

TEMPEST

Why is physical security so critical for digital forensics labs?

To maintain chain of custody and prevent data from being lost, corrupted, or stolen

An employer can be held liable for e-mail harassment. True or False?

True. An employer is responsible for preventing and investigating harassment of employees and nonemployees associated with the workplace.

The manager of a digital forensics lab is responsible for which of the following? (Choose all that apply) a. Making necessary changes in lab procedures and software b. Ensuring that staff members have enough training to do the job c. Knowing the lab objectives d. None of the above

a, b, c

Building a business case can involve which of the following? a. Procedures for gathering evidence b. Testing software c. Protecting trade secrets d. All of the above

d. All of the above