Data Forensics I PRETEST
When was the Freedom of Information Act originally enacted?
1960s
When recovering evidence from a contaminated crime scene, the investigator should take measures to avoid damage to the drive from overheating. At what temperature should the investigator take action?
80 degrees or higher
What does the investigator in a criminal or public-sector case submit, at the request of the prosecuting attorney, if he or she has enough information to support a search warrant?
An affidavit
What term refers to the individual who has the power to conduct digital forensic investigations?
Authorized requester
In what process is the acquisition of newer and better resources for investigation justified?
Building a business case
A technician is trying to recover information on a computer that has been hidden or deleted on purpose in order to hide evidence of a crime. Which type of task is the technician performing?
Data recovery
The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. What are these cluster addresses called?
Data runs
What term refers to a person using a computer to perform routine tasks other than systems administration?
End user
What must be done, under oath, to verify that the information in the affidavit is true?
It must be notarized
What type of acquisition is used for most remote acquisitions?
Live
What is most often the focus of digital investigations in the private sector?
Misuse of digital assets
Which filename refers to the Windows XP system service dispatch stubs to executables functions and internal support functions?
Ntdll.dll
What type of evidence do courts consider evidence data in a computer to be?
Physical
If your time is limited, what type of acquisition data copy method should you consider?
Sparse
Which technique can be used for extracting evidence from large systems?
Sparse acquisition
Under what circumstances are digital records considered admissible?
They are business records
What command works similarly to the dd command but has many features designed for computer forensics acquisitions?
dcfldd