Cyber Forensics Chapters 13, 14, 15 & 16

The American Bar Association (ABA) is a licensing body, and the ABA's Model Code of Professional Responsibility (Model Code) and its successor, the Model Rules of Professional Conduct (Model Rules), are the basis of state licensing bodies' codes.

False

The American Bar Association (ABA) is a licensing body.

False

The HTCIA provides a detailed Code of Ethics of Professional Standards Conduct for everyone involved in the judicial system.

False

The Introduction section starts by referring to the report's purpose, states the main points, draws conclusions, and possibly renders an opinion.

False

The decimal numbering system is frequently used when writing pleadings.

False

The role of consulting expert cannot be changed to expert witness later.

False

The written report must include, in the witness's curriculum vitae, a list of all cases in which the expert did not provide expert testimony or cases in which the expert testified as a lay witness.

False

The written report must include, in the witness's curriculum vitae, a list of all other civil or criminal cases in which he/she has testified for the preceding 6 years.

False

When writing a report, use a natural language style. For instance, talk about yourself in the third person, not first person.

False

When you are working on a case, you are working for the client (plaintiff or defendant) since s/he is the one paying you.

False

You can have "off the record" conversation with the opposing attorney even after you have been retained as long as nothing is put in writing.

False

You only need to update the stock definitions infrequently.

False

The Principles of Medical Ethics is the foundation of medical ethics, supplemented with the Hippocratic Oath.

False (It's the opposite)

prescribe the methods by which experts appear at trial

Federal Rules of Evidence (FRE)

The rule that states that testimony is inadmissible unless it is "testimony deduced from a well-recognized scientific principle or discovery; the thing from which the deduction is made must be sufficiently established to have gained general acceptance in the particular field in which it belongs", was established in what court case?​

Frye v. United States

Has applications such as a word processor, graphics program, online form and survey tool, and a PDF viewer and editor.

Google Drive

_______________ is used to get information when it is believed there is a danger of death or serious physical injury or for the National Center for Missing and Exploited Children.

Government agency subpoenas

provides a well-defined, simple guide for expected behavior of computer forensics examiners

IACIS

All of the following, EXCEPT ___________, are questions to review when preparing your testimony.

Is my client guilty or innocent of the charge?

Which of the following is FALSE regarding service level agreements?

It defines the scope of services the CSP provides and what responsibilities are expected of the customer.

Metadata in a prefetch file contains an application's _____________ times in UTC format and a counter of how many times the application has run since the prefect file was created.​

MAC

The __________________ file contains cid (client ID), clientType, clientVersion, device, deviceID, and timeUtc values relevant to OneDrive.

SyncDiagnostics.log

Anything that you write down as part of your examination for a report is subject to discovery from the opposing attorney.

True

As an expert witness, you have opinions about what you have found or observed.

True

Digital forensics examiners could be held liable when conducting an investigation involving cloud data.

True

Ideas and organization is one of the criteria to assess the quality of your writing.

True

In the United States, the Electronic Communications Privacy Act (ECPA) describes 5 mechanisms the government can use to get electronic information from a provider.​

True

In the United States, there's no state or national licensing body for computer forensics examiners.

True

No single source offers a definitive code of ethics for expert witnesses, so you must draw on standards from other organizations to form your own ethical standards.

True

People need ethics to help maintain their balance, especially in difficult and contentious situations.

True

The law required that an expert who doesn't have personal knowledge about the system or occurrence must state opinion based on hypothetical questions.

True

The more restrictive and specific the ethical rules are, the more impact they have in curbing unethical expert testimony.

True

The most important laws applying to attorneys and witnesses are the rules of evidence.

True

The purpose of requesting the retainer is to deter attorneys from communicating with you solely for the purpose of discrediting or disqualifying you.

True

The written report must include his/her compensation for the service.

True

A written report is frequently a(n) ____ or a declaration.

affidavit

If necessary, you can include ____ containing material such as raw data, figures not used in the body of the report, and anticipated exhibits.

appendixes

​What are the first 8 bits of a Unicode value used for?

character hexidecimal values

Save broader generalizations and summaries for the report's ____.

conclusion

A report using the ____ numbering system divides material into sections and restarts numbering with each main section.

decimal

Attorneys search ____ for information on expert witnesses.

deposition banks

You provide ____ testimony when you answer questions from the attorney who hired you.

direct

The ____ is the most important part of testimony at a trial.

direct examination

What information below is not something recorded in Google Drive's snapshot.db file?​

file SHA values and sizes

The _________ is used to identify, label, record, and acquire data from the cloud.

forensic data collection tool

Before you begin writing your report, you must _____.

identify the purpose of the report

All of the following, EXCEPT a(n) ________, might be a client who should define the investigation's goal or mission.

judge

To prove your conformity with scientific and professional standards, you need to list all of the following, EXCEPT _________.

newspaper articles relevant to the case

When writing a report, group related ideas and sentences into ___________________,​

paragraphs

The _____________ ​cloud service is most likely found on a desktop or a server, although it could also be found on a company network or the remote service provider's infrastructure.

platform as a service

A _____________ is a contract between a CSP and a customer that describes what services are being provided and at what level.​

service level agreement

​With cloud systems running in a virtual environment, _______________ can give you valuable information before, during, and after an incident.

snapshot

Your curriculum vitae should list all of the following coursework, EXCEPT ___________.

sponsored by local non-profit organizations

Regarding a trial, the term ____ means rejecting potential jurors.

strikes

Which is not a valid method of deployment for a cloud?​

targeted

As part of your preparation, you confirm your findings with ______________.

your own documentation

The report generator in ProDiscover defaults to ______________________, which can be opened by most word processors.​

​Rich Text Format (RTF)

What cloud service listed below provides a freeware type 1 hypervisor used for public and private clouds?​

​XenServer and XenCenter Windows Management Console

All of the following, EXCEPT ___________, are guidelines to follow when collecting evidence.

Collect every piece of evidence that you see.

Once a written report is submitted to court, the investigator will not be called to examine or be cross-examined in court.

False

OpenStack is an open-source computing platform intended only for public cloud services.

False

The AMA policy on expert witness testimony states that physicians may accept a contingency fee.

False

The __________________________ is an organization that has developed resource documentation for CSPs and their staff. It provides guidance for privacy agreements, security measures, questionnaires, and more.​

Cloud Security Alliance

Sometimes refers to external rules.

Code of professional conduct or responsibility

In a prefetch file, the application's last access date and time are at offset _______________.​

0x90

On NTFS drives, Unicode values are how many bits in length?

16 bits

FRE ____ describes whether the expert is qualified and whether the expert opinion can be helpful.

702

____ offers the most comprehensive regulations of any professional organization and devote an entire section to forensics activities.

APA's Ethics Code

Where is the snapshot database created by Google Drive located in Windows?​

C:\Users\​username​\AppData\Local\\Google\Drive

Council on Ethical and Judicial Affairs

Created by AMA

Offers third-party applications, such as e-mail, chat, Cisco WebEx, and other collaboration tools.

Dropbox

Which of the following is NOT true regarding expert witnesses and ethics?

Expert witnesses are allowed to bring their biases and other ethical failings to court.

A feature of FROST is that it requires a virtual machine's hypervisor to run.

False

An attorney can coax opinions from expert witnesses to get reliable testimony.

False

An expert witness present the case's evidence that meets the relevance standard and explain what it is and how it was obtained.

False

Create a formal checklist of your procedures that's applied to all your cases or include such a checklist in your report.

False

It is your responsibility to have graphical exhibits admitted into evidence.

False

Like a job resume, your CV should be geared for a specific trial.

False

____ is a written list of objections to certain testimony or exhibits.

Motion in limine

_________ means many different unrelated businesses and users share the same applications and storage space, so forensics tools must be able to separate each customer's data.

Multitenancy

Microsoft cloud service

OneDrive

Which of the following is NOT a guideline provided by The International Society of Forensic Computer Examiners (ISFCE) Code of Ethics and Professional Responsibility?

Reveal any confidential matters or knowledge learned in an examination without an order from a court of competent jurisdiction or the client's express permission.

All of the following, EXCEPT ____________, are guidelines to ensure the integrity of your evidence.

When writing the report, list all the evidence and findings in the case.