Digital Forensics Quiz 13-16

If you're examining a forensic NTFS image from a Windows 7 or older system, you'll see two attribute ____: one for the short filename and one for the long filename. 0xF8 0xAB 0x01 0x30

" "0x30

At what offset is a prefetch file's create date & time located? 0x88 0x80 0x90 0x98

" "0x80

In a prefetch file, the application's last access date and time are at offset ____. 0x90 0xD4 0x80 0x88

" "0x90

Jurors typically average just over ____ years of education and an eighth-grade reading level. 9 10 11 12

" "12

When cases go to trial, you as a forensics examiner can play one of ____ roles. 2 3 4 5

" "2

Which of the following options would represent a valid retainer? a verbal agreement 2 to 8 hours of your usual billable rate complete discussion of an ongoing case dissemination of evidence

" "2 to 8 hours of your usual billable rate

The abstract should be one or two paragraphs totaling about 150 to ____ words. 200 250 300 350

" "200

If your CV is more than ____ old, you probably need to update it to reflect new cases and additional training. 2 months 3 months 3 weeks 5 weeks

" "3 months

If a microphone is present during your testimony, place it ____ to eight inches from you. 3 4 5 6

" "6

FRE ____ describes whether the expert is qualified and whether the expert opinion can be helpful. 702 703 704 705

" "702

FRE ____ describes whether basis for the testimony is adequate. 700 701 702 703

" "703

An expert's opinion is governed by FRE, Rule ____, and the corresponding rule in many states. 705 755 805 855

" "705

Which of the following is not a valid source for cloud forensics training? A+ Security INFOSEC Intitute Sans Cloud Forensics with F-Response (ISC)2 Certified Cyber Forensics Professional

" "A+ Security

The ____ has stated that, unlike attorneys, expert witnesses do not owe a duty of loyalty to their clients. HTCIA ABA ISFCE IACIS

" "ABA

____ offers comprehensive regulations for Psychologists, with an entire section devoted to forensics activities. ABA's Model Rule AMA's law APA's Ethics Code ABA's Model Codes

" "APA's Ethics Code

____ provide additional resource material not included in the body of the report. Discussion Conclusion Appendixes References

" "Appendixes

Where is the snapshot database created by Google Drive located in Windows? C:\Users\username\Google\Google Drive C:\Program Files\Google\Drive C:\Users\username\AppData\Local\Google\Drive\user_default C:\Google\Drive

" "C:\Users\username\AppData\Local\Google\Drive\user_default

Select the folder below that is most likely to contain Dropbox files for a specific user: C:\Users\Dropbox C:\Users\username\AppData\Dropbox C:\Dropbox C:\Users\username\Dropbox

" "C:\Users\username\Dropbox

For forensics examiner, keeping the ____ updated and complete is crucial to supporting your role as an expert and showing that you're constantly enhancing your skills through training, teaching, and experience. CV deposition testimony examination plan

" "CV

The ____ is an organization that has developed resource documentation for CSPs and their staff. It provides guidance for privacy agreements, security measures, questionnaires, and more. OpenStack Framework Alliance Cloud Architecture Group vCloud Security Advisory Panel Cloud Security Alliance

" "Cloud Security Alliance

____ is an attempt by opposing attorneys to prevent you from serving on an important case. Conflict of interest Conflicting out Deposition Warrant

" "Conflicting out

According to ____, to provide reliable and valid testimony, the expert has the "ethical responsibility to present a complete and unbiased picture of the . . . research relevant to the case at hand." Daubert ABA IACIS APA

" "Daubert

____ isn't usually punitive, but it can be embarrassing for you as a professional and potentially for the attorney who retained you. Professional responsibility Conflicting out Disqualification Admonition

" "Disqualification

____ evidence is evidence that exonerates or diminishes the defendant's liability. Inculpatory Plaintiff Exculpatory Rebuttal

" "Exculpatory

The ____ tool can be used to bypass a virtual machine's hypervisor, and can be used with OpenStack. WinHex ARC OpenForensics FROST

" "FROST

Reports and logs generated by forensic tools are typically in text format, word processing, spreadsheet, or ____ format. PDF HTML TXT PS

" "HTML

____ questions can give you the factual structure to support and defend your opinion. Rapid-fire Setup Compound Hypothetical

" "Hypothetical

Metadata in a prefetch file contains an application's ____ times in UTC format and a counter of how many times the application has run since the prefect file was created. ACL MAC startup / access log event

" "MAC

____ is a written list of objections to certain testimony or exhibits. Plaintiff Empanelling the jury Motion in limine Defense

" "Motion in limine

Microsoft created SkyDrive as a cloud service that later became? Teams MS Drive OneDrive Box

" "OneDrive

Attorneys can now submit documents electronically in many courts; the standard format in U.S. federal courts is ____. Portable Document Format (PDF) Microsoft Word (DOC) Postscript (PS) Encapsulated Postscript (EPS)

" "Portable Document Format (PDF)

____ from both the plaintiff's and defense's attorneys is an optional phase of the trial. Generally, it's allowed to cover an issue raised during cross-examination of a witness. Opening statements Closing arguments Plaintiff Rebuttal

" "Rebuttal

What cloud application offers a variety of cloud services, including automation and CRM, cloud application development, and Web site marketing? Amazon EC2 HP Helion Salesforce IBM Cloud

" "Salesforce

Which of the following is NOT a service level for the cloud? Platform as a service Virtualization as a service Software as a service Infrastructure as a service

" "Virtualization as a service

In what court case did the court summarize the process of determining whether an expert should be disqualified because of previous contact with an opposing party? Tidemann v. Toshiba Corp Hewlett-Packard Co. v. EMC Corp Wang Laboratories, Inc. v. Toshiba Corp Tidemann v. Nadler Golf Car Sales, Inc.

" "Wang Laboratories, Inc. v. Toshiba Corp

What cloud service listed below provides a freeware type 1 hypervisor used for public and private clouds? XenServer and XenCenter Windows Management Console HP Helion Cisco Cloud Computing Amazon EC2

" "XenServer and XenCenter Windows Management Console

If a report is long and complex, you should provide a(n) ____. appendix abstract table of contents glossary

" "abstract

A written report is frequently a(n) ____ or a declaration. subpoena deposition affidavit perjury

" "affidavit

If necessary, you can include ____ containing material such as raw data, figures not used in the body of the report, and anticipated exhibits. appendixes references discussions conclusions

" "appendixes

In the main section of your report, you typically cite references with the ____ enclosed in parentheses. author's last name year of publication year of publication and author's last name author's last name and year of publication

" "author's last name and year of publication

Discuss any potential problems with your attorney ____ a deposition. after during direct examination at before during

" "before

Sometimes opposing attorneys ask several questions inside one question; this practice is called a ____ question. rapid-fire hypothetical leading compound

" "compound

Save broader generalizations and summaries for the report's ____. conclusion discussion appendixes introduction

" "conclusion

The report's ____ should restate the objectives, aims, and key questions and summarize your findings with clear, concise statements. conclusion abstract reference introduction

" "conclusion

Before allowing an attorney to describe any case details, determine who the parties are to reduce the possibility of a ____. mistrial collaberation conflict contradiction

" "conflict

Some attorneys contact many experts as a ploy to disqualify them or prevent opposing counsel from hiring them; this practice is called "____." conflicting out discrimination disqualification blocking

" "conflicting out

A consultant who doesn't testify can earn a ____ for finding testifying experts or investigative leads. retainer reprimand stake in a case contingency fee

" "contingency fee

A ____ is written by a judge to compel someone to do or not do something, such as a CSP producing user logon activities. court order temporary restraining order subpoena warrant

" "court order

A report using the ____ numbering system divides material into sections and restarts numbering with each main section. roman-sequential legal-sequential indent decimal

" "decimal

A ____ differs from a trial testimony because there is no jury or judge. rebuttal plaintiff civil case deposition

" "deposition

Attorneys search ____ for information on expert witnesses. deposition banks cross-examination banks disqualification banks examination banks

" "deposition banks

You provide ____ testimony when you answer questions from the attorney who hired you. direct rebuttal examination cross

" "direct

The ____ is the most important part of testimony at a trial. motions in limine rebuttal direct examination cross-examination

" "direct examination

Remember that anything you write down as part of your examination for a report in a civil litigation case is subject to ____ from the opposing attorney. discovery subpoena publishing deposition

" "discovery

There are two types of depositions: ____ and testimony preservation. rebuttal examination discovery direct

" "discovery

The report body consists of the introduction and ____ sections. discussion abstract conclusion appendixes

" "discussion

A(n) ____ based on an ethical lapse could effectively be a death sentence for a career as an expert witness. conflicting out disqualification discrimination identification

" "disqualification

You can use the ____ to help your attorney learn the terms and functions used in digital forensics. examination plan preliminary report final report verbal report

" "examination plan

Forensics examiners have two roles: fact witness and ____ witness. professional direct discovery expert

" "expert

The ____ Dropbox file stores information on shared directories associated with a Dropbox user account and file transfers between Dropbox and the client's system. filetx.log filecache.dll read_filejournal filecache.dbx

" "filecache.dbx

Validate your tools and verify your evidence with ____ to ensure its integrity. hash algorithms steganography watermarks digital certificates

" "hash algorithms

A written preliminary report is considered a ____ document because opposing counsel can demand discovery on it. no-risk low-risk high-risk middle-risk

" "high-risk

The method for expressing an opinion is to have an attorney frame a ____ question based on available factual evidence. nested hypothetical challenging contradictory

" "hypothetical

People who fear having their ____ acts revealed feel as though they must protest the ____ acts of others being revealed. secret improper public legal

" "improper

Typically, report writers use one of two numbering systems: decimal numbering or ____ numbering. letter-sequential roman-sequential arabic-sequential legal-sequential

" "legal-sequential

A ____ is a tool with application programming interfaces (APIs) that allow reconfiguring a cloud on the fly; it's accessed through the application's Web interface. programming language management plane backdoor configuration manager

" "management plane

Generally, the best approach your attorney can take in direct examination is to ask you ____ questions and let you give your testimony. rapid-fire setup compound open-ended

" "open-ended

A(n) ____ is a file or folder that has lost its link to the parent folder. blank file null file space file orphan file

" "orphan file

To reduce the time it takes to start applications, Microsoft has created ____ files, which contain the DLL pathnames and metadata used by applications. temp config prefetch cache

" "prefetch

The purpose of requesting the ____ is to deter attorneys from communicating with you solely for the purpose of disqualifying you. evidence retainer case juror list

" "retainer

The most important laws applying to attorneys and witnesses are the ____. professional codes of conduct rules of evidence professional ethics rules of ethics

" "rules of evidence

To get a ____, a government entity must show that there's probable cause to believe the contents of a wire communication, an electronic communication, or other records are relevant to an ongoing criminal investigation. TRO CSP's log records seizing order search warrant

" "search warrant

Which of the following is not one of the five mechanisms the government can use to get electronic information from a provider? seizure order court orders search warrants subpoenas

" "seizure order

Leading questions such as "Isn't it true that forensics experts always destroy their handwritten notes?" are referred to as ____ questions. nested hypothetical attorney setup

" "setup

With cloud systems running in a virtual environment, ____ can give you valuable information before, during, and after an incident. snapshots carving RAM live acquisition

" "snapshots

Regarding a trial, the term ____ means rejecting potential jurors. venireman voir dire strikes rebuttal

" "strikes

The Google drive file ____ contains a detailed list of a user's cloud transactions. history.db loggedtransactions.log sync_log.log transact_user.db

" "sync_log.log

When you give ____ testimony, you present this evidence and explain what it is and how it was obtained. lay witness technical/scientific deposition expert

" "technical/scientific

A(n) ____ is sworn to under oath (and penalty of perjury or comparable false swearing statute). written report verbal report cross-examination report examination plan

" "written report

A(n) ____ is a document that serves as a guideline for knowing what questions to expect when you are testifying. examination plan subpoena affidavit written report

"examination plan