Question 1

Which of the following is NOT an advantage attributed to the introduction of disk operating systems?

Accepted Answer

A)  It provides for the storage of documents in contiguous sectors. 
B)  It reduces the data management burden of applications. 
C)  It allows application-specific disk hierarchies. 
D)  It maximizes the use of limited space. 
A)  It provides for the storage of documents in contiguous sectors. 
B)  It reduces the data management burden of applications. 
C)  It allows application-specific disk hierarchies. 
D)  It maximizes the use of limited space. A

Question 2

Which of the following is an example of a disk recovery and extraction tool?

Accepted Answer

A)  Tech Assist's ByteBack 
B)  Norton Utilities 
C)  Access Data's Forensic Toolkit 
D)  Ultimate Toolkit 
A)  Tech Assist's ByteBack 
B)  Norton Utilities 
C)  Access Data's Forensic Toolkit 
D)  Ultimate Toolkit B

Question 3

The BIOS is stored in the Encrypting File System (EFS).

Accepted Answer

A) True 
 B)False  False

Question 4

The familiarity and utilization of ________ may result in a situation where investigators know just enough to make them potentially hazardous to the investigation.

Accepted Answer

The answer of The familiarity and utilization of ________ may...

Question 5

Which of the following refers to the area of a computer that holds data during processing and is erased when power is shut down?

Accepted Answer

A)  static memory 
B)  primary storage 
C)  volatile memory 
D)  secondary storage 
A)  static memory 
B)  primary storage 
C)  volatile memory 
D)  secondary storage

Question 6

A(n) ________FAT is used if a disk requires less than 65,536 but more than 4,096 clusters.

Accepted Answer

A)  4-bit 
B)  16-bit 
C)  8-bit 
D)  32-bit 
A)  4-bit 
B)  16-bit 
C)  8-bit 
D)  32-bit

Question 7

Which of the following are the three primary components of a computer?

Accepted Answer

A)  hardware, firmware, operating systems 
B)  firmware, hardware, software 
C)  software, hardware, operating systems 
D)  firmware, software, Maresware 
A)  hardware, firmware, operating systems 
B)  firmware, hardware, software 
C)  software, hardware, operating systems 
D)  firmware, software, Maresware

Question 8

Which of the following factors is most important in determining the type of tool to be used in a computer forensics investigation?

Accepted Answer

A)  type of crime encountered 
B)  type of information 
C)  type of concealment 
D)  type of suspect device 
A)  type of crime encountered 
B)  type of information 
C)  type of concealment 
D)  type of suspect device

Question 9

Which of the following terms refers to a suspect's guilty mind or intent, as might be demonstrated by the use of data hiding or drive wiping techniques?

Accepted Answer

A)  mens rea 
B)  harm 
C)  actus reus 
D)  ownership 
A)  mens rea 
B)  harm 
C)  actus reus 
D)  ownership

Question 10

Most contemporary integrated packages have stand-alone imaging programs.

Accepted Answer

A) True 
 B)False

Question 11

The physical extraction phase identifies and recovers files and data based on the installed operating system, file system, and/or application.

Accepted Answer

A) True 
 B)False

Question 12

Which of the following programs extends decryption capabilities beyond a single computer by using the distributed power of multiple computers across a network to decrypt files and recover passwords?

Accepted Answer

A)  Password Recovery Toolkit 
B)  FTK Imager 
C)  Distributed Network Attack 
D)  Registry Viewer 
A)  Password Recovery Toolkit 
B)  FTK Imager 
C)  Distributed Network Attack 
D)  Registry Viewer

Question 13

Traditionally, suspect drivers and disks were copied at the ________ level.

Accepted Answer

The answer of Traditionally, suspect drivers and disks were copied...

Question 14

Which of the following is NOT a step included in the logical extraction of data?

Accepted Answer

A)  data reduction through comparison 
B)  extraction of file slack 
C)  recovery of deleted files 
D)  evaluation of the partition table 
A)  data reduction through comparison 
B)  extraction of file slack 
C)  recovery of deleted files 
D)  evaluation of the partition table

Question 15

A ________ is the number of bytes that represent about one-half page of text.

Accepted Answer

The answer of A ________ is the number of bytes...

Question 16

Many agencies do not avail themselves of the free training courses provided by the FBI and the Federal Law Enforcement Training Center as the agencies are unable to afford the loss of personnel.

Accepted Answer

A) True 
 B)False

Question 17

________ allow front-page viewing of multiple files, thus enabling investigators to quickly identify questionable graphics files.

Accepted Answer

The answer of ________ allow front-page viewing of multiple files,...

Question 18

The development and regular review of which of the following is essential as technology changes?

Accepted Answer

A)  cyclical redundancy checksum 
B)  master boot record 
C)  standard operating procedures 
D)  cipher combination locks 
A)  cyclical redundancy checksum 
B)  master boot record 
C)  standard operating procedures 
D)  cipher combination locks

Question 19

________ are devices and data at the electronic or machine level.

Accepted Answer

The answer of ________ are devices and data at the...

Question 20

Which of the following is true of a hexadecimal system?

Accepted Answer

A)  Interpretative rules are associated with a base of two with integers represented by zeroes and ones. 
B)  Interpretative rules are associated with a base of 16 with integers ranging from 0 to 9 and A to F. 
C)  The range of whole numbers that can be represented by a single byte is 0 to 255. 
D)  Investigators do not need to evaluate files with a hexadecimal viewer. 
A)  Interpretative rules are associated with a base of two with integers represented by zeroes and ones. 
B)  Interpretative rules are associated with a base of 16 with integers ranging from 0 to 9 and A to F. 
C)  The range of whole numbers that can be represented by a single byte is 0 to 255. 
D)  Investigators do not need to evaluate files with a hexadecimal viewer.

Which of the following is NOT an advantage attributed to the introduction of disk operating systems?

Which of the following is an example of a disk recovery and extraction tool?

The BIOS is stored in the Encrypting File System (EFS).

The familiarity and utilization of ________ may result in a situation where investigators know just enough to make them potentially hazardous to the investigation.

Which of the following refers to the area of a computer that holds data during processing and is erased when power is shut down?

A(n) ________FAT is used if a disk requires less than 65,536 but more than 4,096 clusters.

Which of the following are the three primary components of a computer?

Which of the following factors is most important in determining the type of tool to be used in a computer forensics investigation?

Which of the following terms refers to a suspect's guilty mind or intent, as might be demonstrated by the use of data hiding or drive wiping techniques?

Most contemporary integrated packages have stand-alone imaging programs.

The physical extraction phase identifies and recovers files and data based on the installed operating system, file system, and/or application.

Which of the following programs extends decryption capabilities beyond a single computer by using the distributed power of multiple computers across a network to decrypt files and recover passwords?

Traditionally, suspect drivers and disks were copied at the ________ level.

Which of the following is NOT a step included in the logical extraction of data?

A ________ is the number of bytes that represent about one-half page of text.

Many agencies do not avail themselves of the free training courses provided by the FBI and the Federal Law Enforcement Training Center as the agencies are unable to afford the loss of personnel.

________ allow front-page viewing of multiple files, thus enabling investigators to quickly identify questionable graphics files.

The development and regular review of which of the following is essential as technology changes?

________ are devices and data at the electronic or machine level.

Which of the following is true of a hexadecimal system?

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Searching and Seizing Computer-Related Evidence

Processing of Evidence and Report Preparation

Conclusions and Future Issues

Filters

Exam 10: Computer Forensics: Terminology and Requirements

Which of the following is NOT an advantage attributed to the introduction of disk operating systems?

Which of the following is an example of a disk recovery and extraction tool?

The BIOS is stored in the Encrypting File System (EFS).

The familiarity and utilization of ________ may result in a situation where investigators know just enough to make them potentially hazardous to the investigation.

Which of the following refers to the area of a computer that holds data during processing and is erased when power is shut down?

A(n) ________FAT is used if a disk requires less than 65,536 but more than 4,096 clusters.

Which of the following are the three primary components of a computer?

Which of the following factors is most important in determining the type of tool to be used in a computer forensics investigation?

Which of the following terms refers to a suspect's guilty mind or intent, as might be demonstrated by the use of data hiding or drive wiping techniques?

Most contemporary integrated packages have stand-alone imaging programs.

The physical extraction phase identifies and recovers files and data based on the installed operating system, file system, and/or application.

Which of the following programs extends decryption capabilities beyond a single computer by using the distributed power of multiple computers across a network to decrypt files and recover passwords?

Traditionally, suspect drivers and disks were copied at the ________ level.

Which of the following is NOT a step included in the logical extraction of data?

A ________ is the number of bytes that represent about one-half page of text.

Many agencies do not avail themselves of the free training courses provided by the FBI and the Federal Law Enforcement Training Center as the agencies are unable to afford the loss of personnel.

________ allow front-page viewing of multiple files, thus enabling investigators to quickly identify questionable graphics files.

The development and regular review of which of the following is essential as technology changes?

________ are devices and data at the electronic or machine level.

Which of the following is true of a hexadecimal system?

Introduction and Overview of Computer Forensics and Cybercrime

Computer Terminology and History

Traditional Computer Crime: Early Hackers and Theft of Components

Contemporary Computer Crime

Identity Theft and Identity Fraud

Terrorism and Organized Crime

Avenues for Prosecution and Government Efforts

Applying the First Amendment to Computer-Related Crime

The Fourth Amendment and Other Legal Issues

Searching and Seizing Computer-Related Evidence

Processing of Evidence and Report Preparation

Conclusions and Future Issues

Filters