Cybercrime Midterm

In Linux most system configuration files are stored in the ____ directory.

/etc

Ext4f can support disk partitions as large as ____ TB.

16

Image files can be reduced by as much as ____% of the original when using lossless compression.

50

Older Microsoft disk compression tools, such as DoubleSpace or ____, eliminate only slack disk space between files.

DriveSpace

Computer investigations and forensics fall into the same category: public investigations. True or False?

False

ISPs can investigate computer abuse committed by their customers.

False

If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available.

False

Private-sector organizations include small to medium businesses, large corporations, and non-government organizations (NGO's), which always get funding from the government or other agencies (T or F)

False

The law of search and seizure protects the rights of all people, excluding people suspected of crimes. True or False

False

When you work in the enterprise digital group, you test and verify the integrity of standalone workstations and network servers. True or False?

False

Windows OS does not have a kernel . True or False

False

macOS is built with the new Apple File System (APFS). The current version offers better security, encryption, and performance speeds, but users can't mount HFS+ drives. True or False

False

often work as part of a team to secure an organization's computers and networks.

Forensic Investigators

Published company policies provide a(n) ____ for a business to conduct internal investigations

Line of authority

Linux ISO images that can be burned to a CD or DVD are referred to as ____.

Linux live cds

If the computer has an encrypted drive, a ____ acquisition is done if the password or passphrase is available.

Live

Autopsy uses ____ to validate an image.

MD5

On older Mac OSs all information about the volume is stored in the ____.

Master Directory Block (MDB)

Most digital investigations in the private sector involve ______

Misuse of digital assets

The affidavit must be _____ under sworn oath to verify that the information in the affidavit is true

Notarized

With ____, Macintosh moved to the Intel processor and became UNIX based.

OS X

is the standard specifying whether a police officer has the right to make an arrest, conduct a personal or property search, or obtain a warrant for arrest.

Probable Cause

Acquisition of RAID drives can be challenging and frustrating for digital forensics examiners because of how RAID systems are designed, configured, and sized.

True

After a judge approves and signs a search warrant, it's ready to be executed, meaning you can collect evidence as defined by the warrant. True or False

True

By the 1970s, electronic crimes were increasing, especially in the financial sector True or False?

True

Ext3 is a journaling version of Ext2 that has a built-in file recovery mechanism used after a crash. True or False?

True

If a file contains information, it always occupies at least one allocation block. True or False

True

The definition of digital forensics has evolved over the years from simply involving securing and analyzing digital information stored on a computer for use as evidence in civil, criminal, or administrative cases.

True

The pipe (|) character redirects the output of the command preceding it. True or False?

True

The police blotter provides a record of clues to crimes that have been committed previously. True or False?

True

When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data

U.S. DOJ

During an investigation involving a live computer, do not cut electrical power to the running system unless it's older ____ or MS-DOS system

Windows

Confidential business data included with the criminal evidence are referred to as ____ data.

commingled

involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.

data recovery

The ____ command, works similarly to the dd command but has many features designed for computer forensics acquisitions.

dcfldd

The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.

dd

The ____ group manages investigations and conducts forensic analysis of systems suspected of containing evidence related to an incident or a crime.

digital investigations

It's the investigator's responsibility to write the affidavit, which must include ____ (evidence) that support the allegation to justify the warrant.

exhibits

A(n) ____ should include all the tools you can afford to take to the field.

extensive-response field kit

With a(n) _____ you can arrive at a scene, acquire the data you need, and return to the lab as quickly as possible

initial-response field kit

Your ____ as a digital investigation and forensics analyst is critical because it determines your credibility.

professional conduct

n macOS, when you're working with an application file, the ____ fork contains additional information, such as menus, dialog boxes, icons, executable code, and controls.

resource

Corporations often follow the ____ doctrine, which is what happens when a civilian or corporate investigative agent delivers evidence to a law enforcement officer

silver platter

If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.

sparse

A ____ usually appears when a computer starts or connects to the company intranet, network, or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer systems and network traffic at will.

warning banner

Law enforcement investigators need a(n) ___ to remove computers from a crime scene and transport them to a lab

warrant