Certificaton Objectives Exam 4

At what offset is a prefetch file's create date and time located?

0x80

At what offset are the application's last access date and time located in a prefetch file?

0x90

How many years of education does the typical juror have?

12

How many words should an abstract contain?

150 to 200

How many roles might a forensics examiner play in a trial?

2

Which of the following options would represent a valid retainer?

2 to 8 hours of your usual billable rate

How close should a microphone be to the person testifying?

6 to 8 inches

Which Federal Rule of Evidence is used to determine whether the expert is qualified and whether the expert opinion can be helpful?

702

Which Federal Rule of Evidence rule governs expert opinions?

705

What document, issued by a judge, compels the recipient to do or not do something?

A court order

Which type of order requires that the government offer specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation?

A court order

Which type of tool has application programming interfaces (APIs) that allow reconfiguring a cloud on the fly and is accessed through the application's Web interface?

A management plane

Attorneys who contact many experts as a ploy to disqualify them or prevent opposing counsel from hiring them are using what practice?

Conflicting out

What method might be used by opposing attorneys to prevent an investigator from serving on an important case?

Conflicting out

Which tool can be used to bypass a virtual machine's hypervisor, and can be used with OpenStack?

FROST

A search warrant can be used in any kind of case, either civil or criminal.

False

A verbal report is more structured than a written report.

False

As an expert witness, you can't testify if you weren't present when the event occurred.

False

During opening statements, both attorneys provide an overview of the case, with the plaintiff's attorney going last.

False

Expert opinions cannot be presented without stating the underlying factual basis.

False

For civil cases, including those involving digital forensics investigations, U.S. district courts consider optional that expert witnesses submit written reports.

False

Magnet AXIOM Cloud can retrieve information from Skype, Instagram, Twitter, iCloud, but not from Facebook Messenger.

False

Motion in limine includes voir dire of venireman, strikes, and seating of jurors.

False

Remote acquisitions are often easier because you're usually dealing with large volumes of data.

False

The American Bar Association (ABA) is a licensing body.

False

The decimal numbering system is frequently used when writing pleadings

False

The law requires search warrants to contain specific descriptions of what's to be seized. For cloud environments, the property to be seized usually describes physical hardware rather than data, unless the CSP is a suspect.

False

When writing a report, use a formal, technical style

False

When you're aware of a possible disqualification issue, bring it to the attention of the opposing attorney.

False

You should create a formal checklist of your procedures that's applied to all your cases or include such a checklist in your report.

False

In addition to text, word processing, and spreadsheet formats, which format is used for forensic reports and logs generated by forensic tools?

HTML

Because opposing counsel can demand discovery on them, what are written preliminary reports considered to be?

High-risk documents

What should the forensics specialist keep updated and complete in order to support his or her role as an expert and document enhancement of skills through training, teaching, and experience?

His or her CV

What type of questions can give the investigator the factual structure to support and defend his or her opinion?

Hypothetical

In addition to decimal numbering, what numbering system can be used in a written report?

Legal-sequential

What optional phase of a trial typically involves an issue raised during cross-examination of a witness?

Rebuttal

What are the most important laws applying to attorneys and witnesses?

Rules of evidence

What cloud application offers a variety of cloud services, including automation and CRM, cloud application development, and Web site marketing?

Salesforce

Leading questions such as "Isn't it true that forensics experts always destroy their handwritten notes" are referred to as what type of questions?

Setup

With cloud systems running in a virtual environment, what can be used to give the investigator valuable information before, during, and after an incident?

Snapshots

In which cloud service level are applications delivered via the Internet?

Software as a service

In which type of testimony does the investigator present evidence and explain what it is and how it was obtained?

Technical/scientific

Which standard states that, to provide reliable and valid testimony, the expert has the "ethical responsibility to present a complete and unbiased picture of the . . . research relevant to the case at hand"?

The Daubert standard

What section of a report can be used for material such as raw data, figures not used in the body of the report, and anticipated exhibits?

The appendixes

Suppose you have been hired to determine whether a corrupted file was intentionally altered or altered by a virus. Your forensic examination did not find evidence of a virus and did not find evidence of intentional alteration. What conclusion can you offer?

The cause of the file's corruption is unknown.

What section of a report should contain broader generalizations?

The conclusion

What section of a report should restate the objectives, aims, and key questions and summarize the findings with clear, concise statements?

The conclusion

What sections of a report are included in the report body?

The introduction and discussion

What is reduced by knowing who the parties in a case are?

The possibility of conflict of interest

There are inherent conflicts between the goals of attorneys and the goals of scientists or technicians (experts).

True

When searching for specific record information, sometimes you see duplicate files with the same name that have different data runs, meaning the file was written to disk more than once on separate occasions.

True

When writing a report, style means the tone of language you use to address the reader.

True

Whether you're serving as an expert witness or a fact witness, be professional and polite when presenting yourself to any attorney or the court.

True

Which Dropbox file stores information on shared directories associated with a Dropbox user account and file transfers between Dropbox and the client's system?

filecache.dbx

Which Google Drive file contains a detailed list of a user's cloud transactions?

sync_log.log

What type of questions ask several questions inside one question?

Compound

Requesting which of these will deter attorneys from communicating with an investigator solely for the purpose of disqualifying that investigator?

A retainer

A government entity must show that there is probable cause to believe the contents of a wire communication, an electronic communication, or other records are relevant to an ongoing criminal investigation to obtain which type of order?

A search warrant

Which document is sworn to under oath and penalty of perjury, or a comparable false swearing statute?

A written report

Which organization has stated that, unlike attorneys, expert witnesses do not owe a duty of loyalty to their clients?

ABA

Which document offers comprehensive guidance for psychologists, with an entire section devoted to forensics activities?

APA's Ethics Code

What should be provided if a report is long and complex?

An abstract

A written report is often submitted as what type of document?

An affidavit

What is most appropriately used to help an attorney learn the terms and functions used in digital forensics?

An examination plan

Which document serves as a guideline for knowing what questions an investigator should expect when testifying?

An examination plan

Under FRCP, Rule 26, where must the investigator's curriculum vitae be placed unless the bona fides are integrated elsewhere?

Appendixes

How often should the document describing your expertise and used to qualify your testimony be updated to reflect new cases and additional training?

At least every 3 months

Where is the snapshot database created by Google Drive located in Windows?

C:\Users\username\AppData\Local\Google\Drive\user_default

Which folder is most likely to contain Dropbox files for a specific user?

C:\Users\username\Dropbox

Which organization has developed resource documentation for cloud service providers and their staff and provides guidance for privacy agreements, security measures, and other issues?

Cloud Security Alliance

Which numbering system is being used if the report writer divides material into sections and restarts numbering with each main section?

Decimal

What resource might attorneys use to search for information on expert witnesses?

Deposition banks

What is the most important part of an investigator's testimony at a trial?

Direct examination

Anything an investigator writes down as part of examination for a report in a civil litigation case is subject to which action from the opposing attorney?

Discovery

Which type of deposition is used to give an opposing attorney the chance to conduct what amounts to a direct examination and cross-examination of a witness?

Discovery

Which action isn't usually punitive, but can be embarrassing for the professional and potentially for the attorney who retained the professional?

Disqualification

Which outcome, when caused by an ethical lapse, could effectively be a death sentence for a career as an expert witness?

Disqualification

Which term refers to internalized rules used to measure one's own performance?

Ethics

What term refers to evidence that exonerates or diminishes the defendant's liability?

Exculpatory

Which motion provides a written list of objections to certain testimony or exhibits?

Motion in limine

Which cloud forensics training program is limited to law enforcement personnel?

National Institute of Justice Digital Forensics Training

How is a deposition different from trial testimony?

No judge or jury is present during a deposition

What is Microsoft's SkyDrive now called?

OneDrive

Generally, the best approach an attorney can take in direct examination is to ask the investigator what type of questions?

Open-ended

What is the standard format in U.S. federal courts for the electronic submission of documents?

Portable Document Format (PDF)

As a standard practice, collect evidence and record the tools you used in designated file folders or evidence containers.

True

As an expert witness, you have opinions about what you have found or observed.

True

Experts should be paid in full for all previous work and for the anticipated time required for testimony.

True

Homomorphic encryption uses an "ideal lattice" mathematical formula to encrypt data.

True

In 1999, Salesforce.com developed a customer relationship management (CRM) Web service that applied digital marketing research to business subscribers so that they could do their own market analysis; this service eventually led the way to the cloud.

True

In the United States, the Electronic Communications Privacy Act (ECPA) describes five mechanisms the government can use to get electronic information from a provider.

True

In the United States, there's no state or national licensing body for digital forensics examiners.

True

Lawyers use services called deposition banks (libraries), which store examples of expert witnesses' previous testimony.

True

No single source offers a definitive code of ethics for expert witnesses, so you must draw on standards from other organizations to form your own ethical standards.

True

Part of what you have to deliver to the jury is a person they can trust to help them figure out something that's beyond their expertise.

True

People need ethics to help maintain their balance, especially in difficult and contentious situations.

True

Specially trained system and network administrators are often a CSP's first responders.

True

The chain of custody of evidence supports the integrity of your evidence.

True

The platform as a service cloud service is most likely found on a desktop or a server, although it could also be found on a company network or the remote service provider's infrastructure.

True

What cloud service provides a freeware type 1 hypervisor used for public and private clouds?

XenServer and XenCenter Windows Management Console