Computer Forensics Review Questions
What do you call a list of people who have had physical possession of the evidence?
Chain of custody
List two types of digital investigations conducted in a business
Embezzlement and fraud
Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or false?
False
Under normal circumstance, a private-sector investigator is considered an agent of law enforcement. True or False?
False
You should always prove the allegations made by the person who hired you. True or False?
False
Digital forensics and data recovery refer to the same activities. True or False?
False, digital forensics is analyzing and documenting data found on a computer in order to aid a criminal investigation
What are the necessary components of a search warrant?
Probable cause, what you're searching for, who is involved, when the search is taking place and where the evidence will be
List two items that should appear on warning banner
The computer may be subjected to surveillance and the fine that comes with breaking the law
Why should you critique your case after it's finished?
To improve your work and fix your mistakes
For digital evidence, an evidence bag is typically made out of antistatic material. True or False?
True
What are some ways to determine the resources needed for an investigation?
Determine the operating system of the suspect computer and list the necessary software to use for the examination
List three items that should be on an evidence custody form
Name of the investigator, case number and description of the evidence
What is the purpose of maintaining a network of digital forensics specialists?
To develop a list of colleagues who specialize in areas different from your own specialization in case help is needed in an investigation
Why should evidence media be write-protected?
To ensure that data isn't altered in any way - you can use a right blocker to prevent any changes
What is the purpose of an affidavit
To justify issuing a warrant
Professional conduct. Why is it important?
To make sure everyone is comfortable and acting professionally
Why should you do a standard risk assessment to prepare for an investigation?
To make sure you don't accidentally lose the data/evidence
The triad of computing security involves which of the following?
Vulnerability/threat assessment and risk management, network intrusion detecting and incident response, and digital investigation
List three items that should be in your case report
What you found, where you found it, and how you found it
What are some the rules that policies can address?
When you can log on to a company network from home, the internet sites you can or can't access, and the amount of personal email you can send
Police in the United States must use procedures that adhere to...
the fourth amendment