Digital Media Forensics - Cengage/MIndTap Labs
What type of forensic copy should be conducted on the original media? Packet-stream Byte-stream File-system copy Bit-stream
Bit-stream
What is the term for tracking evidence in an investigation? Chain of custody Evidence control and tracking Chain of evidence Sequence of custody
Chain of custody
Of the following choices, which would permanently remove data from media so that it is unrecoverable? Data is no longer accessible once it is deleted Reformatting the hard drive is the only way to fully delete data Data is accessible until it is overwritten by other content to the same physical location You must empty the recycle bin to permanently delete data
Data is accessible until it is overwritten by other content to the same physical location
What Amendment to the U.S. Constitution provides protection against unlawful searches and seizures? Fifth Amendment Third Amendment Sixth Amendment Fourth Amendment
Fourth Amendment
What is the first rule of digital forensics and subsequent analysis of evidence? Store and analyse original evidence only Preserve the original evidence, and analyse a copy only Make a copy of the evidence, but analyse the original only It doesn't matter what copy you use as long as there is a duplicate copy
Preserve the original evidence, and analyse a copy only