Final 165

Jurors typically average just over ____ years of education and an eighth-grade reading level.

12

When cases go to trial, you as a forensics examiner can play one of ____ roles.

2

If your CV is more than ____ old, you probably need to update it to reflect new cases and additional training.

3 months

If a microphone is present during your testimony, place it ____ to eight inches from you.

6

People who want to hide data can also use advanced encryption programs, such as PGP or ____.

BestCrypt

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Brute-force

For forensics examiner, keeping the ____ updated and complete is crucial to supporting your role as an expert and showing that you're constantly enhancing your skills through training, teaching, and experience.

CV

____ have some limitations in performing hashing, however, so using advanced ____ is necessary to ensure data integrity.

Digital forensics tools, hexadecimal editors

Marking bad clusters data-hiding technique is more common with ____ file systems.

FAT

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.

KFF

Many password-protected OSs and applications store passwords in the form of ____ or SHA hash values.

MD5

To enhance searching for and eliminating known OS and application files, Autopsy has an indexed version of the NIST ____ of MD5 hashes.

NSRL

A password recovery program available from AccessData

PRTK

____ recovery is becoming more common in digital forensic analysis.

Password

____ from both the plaintiff's and defense's attorneys is an optional phase of the trial. Generally, it's allowed to cover an issue raised during cross-examination of a witness.

Rebuttal

WinHex provides several hashing algorithms, such as MD5 and ____.

SHA-1

____ alters hash values, which makes cracking passwords more difficult.

Salting passwords

Discuss any potential problems with your attorney ____ a deposition.

before

The data-hiding technique ____ changes data from readable code to data that looks like binary executable code.

bit-shifting

Statements that organize the evidence and state the applicable law.

closing argument

Sometimes opposing attorneys ask several questions inside one question; this practice is called a ____ question.

compound

The practice of opposing attorneys trying to prevent you from testifying by claiming you have discussed the case with them and, therefore, have a conflict of interest.

conflicting out

____ is an attempt by opposing attorneys to prevent you from serving on an important case

conflicting out

Limit a civil investigation

court orders for discovery

The original file with no hidden message

cover media

An extensive outline of your professional history that includes education, training, work, and what cases you have worked o as well as training you have conducted or contributed to.

curriculum Vitae (CV)

A ____ differs from a trial testimony because there is no jury or judge.

deposition

Give the opposing counsel a chance to preview your testimony before trial.

deposition

Program used to clean all data from the target drive you plan to use

digital intelligence PDWipe

You provide ____ testimony when you answer questions from the attorney who hired you.

direct

The ____ is the most important part of testimony at a trial.

direct examination

There are two types of depositions: ____ and testimony preservation.

discovery

The opposing attorney sets the deposition and often conducts the equivalent of both direct and cross-examination. A discovery deposition is considered part of the discovery process.

discovery deposition

One way to hide partitions is with the Windows disk partition utility, ____.

diskpart

____ evidence is evidence that exonerates or diminishes the defendant's liability.

exculpatory

This type of testimony reports opinions based on experience and facts gathered during an investigation.

expert witness

This type of testimony reports only the facts (findings of an investigation); no opinion is given in court.

fact witness

Validate your tools and verify your evidence with ____ to ensure its integrity.

hash algorithms

Data ____ involves changing or manipulating a file to conceal information.

hiding

Defines the investigation's goal and scope, the materials needed, and the tasks to perform

investigation plan

You begin a digital forensics case by creating a(n) ____.

investigation plan

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

key escrow

A pretrial motion to exclude or limit the use of certain evidence because its potential to prejudice the jury would exceed its probative value.

motion in limine

____ is a written list of objections to certain testimony or exhibits.

motion in limine

Generally, the best approach your attorney can take in direct examination is to ask you ____ questions and let you give your testimony.

open ended

Progressing to make any current encryption schemes obsolete

quantum computing

A file containing the hash values for every possible password that can be generated from a computer's keyboard

rainbow table

Designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure

salting passwords

____ increases the time and resources needed to extract, analyze, and present evidence.

scope creep

Leading questions such as "Isn't it true that forensics experts always destroy their handwritten notes?" are referred to as ____ questions.

set up

The converted cover-media file that stores the hidden message

stage-media

The term ____ comes from the Greek word for "hidden writing."

steganography

____ is defined as hiding messages in such a way that only the intended recipient knows the message is there.

steganography

Regarding a trial, the term ____ means rejecting potential jurors.

strikes

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

subpoenas

When you give ____ testimony, you present this evidence and explain what it is and how it was obtained.

technical/scientific

A deposition held to preserve your testimony in case of schedule conflicts or health problems; it's usually video recorded in addition to the written transcript.

testimony preservation deposition

One of the most critical aspects of computer forensics

validating digital evidence

In this qualification phase of testimony, your attorney asks you questions to elicit the qualifications that make you an expert witness.

voir dire

Criminal investigations are limited to finding data defined in the search ____.

warrant