Question 1

In terms of digital evidence, the Internet is an example of:

Accepted Answer

A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above 
A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above B

Question 2

The aim of a forensic examination is to prove with certainty what occurred.

Accepted Answer

A) True 
 B)False  False

Question 3

Forensic science is the application of science to investigation and prosecution of crime or to the just resolution of conflict.

Accepted Answer

A) True 
 B)False  True

Question 4

Automobiles have computers that record data such as vehicle speed, brake status, and throttle position when an accident occurs.

Accepted Answer

A) True 
 B)False

Question 5

Video surveillance can be a form of digital evidence.

Accepted Answer

A) True 
 B)False

Question 6

Due to caseload and budget constraints, often computer security professionals attempt to limit the damage and close each investigation as quickly as possible. Which of the following is NOT a significant drawback to this approach?

Accepted Answer

A)  Each unreported incident robs attorneys and law enforcement personnel of an opportunity to learn about the basics of computer-related crime. 
B)  Responsibility for incident resolution frequently does not reside with the security professional, but with management. 
C)  This approach results in under-reporting of criminal activity, deflating statistics that are used to allocate corporate and government spending on
Combating computer-related crime. 
D)  Computer security professionals develop loose evidence processing habits that can make it more difficult for law enforcement personnel and attorneys to
Prosecute an offender. 
A)  Each unreported incident robs attorneys and law enforcement personnel of an opportunity to learn about the basics of computer-related crime. 
B)  Responsibility for incident resolution frequently does not reside with the security professional, but with management. 
C)  This approach results in under-reporting of criminal activity, deflating statistics that are used to allocate corporate and government spending on
Combating computer-related crime. 
D)  Computer security professionals develop loose evidence processing habits that can make it more difficult for law enforcement personnel and attorneys to
Prosecute an offender.

Question 7

Digital evidence alone can be used to build a solid case.

Accepted Answer

A) True 
 B)False

Question 8

What are the main challenges of investigating computer-related crime?

Accepted Answer

There are an abundance of challenges. A

Question 9

What are the three general categories of computer systems that can contain digital evidence?

Accepted Answer

A)  Desktop, laptop, server 
B)  Personal computer, Internet, mobile telephone 
C)  Hardware, software, networks 
D)  Open computer systems, communication systems, embedded systems 
A)  Desktop, laptop, server 
B)  Personal computer, Internet, mobile telephone 
C)  Hardware, software, networks 
D)  Open computer systems, communication systems, embedded systems

Question 10

When a file is deleted from a hard drive, it can often be recovered.

Accepted Answer

A) True 
 B)False

Question 11

Computers can be used by terrorists to detonate bombs.

Accepted Answer

A) True 
 B)False

Question 12

Computer professionals who take inappropriate actions when they encounter child pornography on their employer's systems can lose their jobs or break the law.

Accepted Answer

A) True 
 B)False

Question 13

The author of a series of threatening e-mails consistently uses "im" instead of "I'm." This is an example of:

Accepted Answer

A)  An individual characteristic 
B)  An incidental characteristic 
C)  A class characteristic 
D)  An indeterminate characteristic 
A)  An individual characteristic 
B)  An incidental characteristic 
C)  A class characteristic 
D)  An indeterminate characteristic

Question 14

Personal computers and networks are often a valuable source of evidence. Those involved with _______ should be comfortable with this technology.

Accepted Answer

A)  Criminal investigation 
B)  Prosecution 
C)  Defense work 
D)  All of t h e above 
A)  Criminal investigation 
B)  Prosecution 
C)  Defense work 
D)  All of t h e above

Question 15

A logon record tells us that, at a specific time:

Accepted Answer

A)  An unknown person logged into the system using the account 
B)  The owner of a specific account logged into the system 
C)  The account was used to log into the system 
D)  None of the above 
A)  An unknown person logged into the system using the account 
B)  The owner of a specific account logged into the system 
C)  The account was used to log into the system 
D)  None of the above

Question 16

Why is it important for computer security professionals to become familiar with digital evidence?

Accepted Answer

So they know how to process ev

Question 17

Digital evidence can be duplicated exactly without any changes to the original data.

Accepted Answer

A) True 
 B)False

Question 18

All forensic examinations should be performed on the original digital evidence.

Accepted Answer

A) True 
 B)False

Question 19

Attorneys and police are encountering progressively more digital evidence in their work.

Accepted Answer

A) True 
 B)False

Question 20

In terms of digital evidence, a Smart Card is an example of:

Accepted Answer

A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above 
A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above

Exam 1: Foundations of Digital Forensics

In terms of digital evidence, the Internet is an example of:

The aim of a forensic examination is to prove with certainty what occurred.

Forensic science is the application of science to investigation and prosecution of crime or to the just resolution of conflict.

Automobiles have computers that record data such as vehicle speed, brake status, and throttle position when an accident occurs.

Video surveillance can be a form of digital evidence.

Due to caseload and budget constraints, often computer security professionals attempt to limit the damage and close each investigation as quickly as possible. Which of the following is NOT a significant drawback to this approach?

Digital evidence alone can be used to build a solid case.

What are the main challenges of investigating computer-related crime?

What are the three general categories of computer systems that can contain digital evidence?

When a file is deleted from a hard drive, it can often be recovered.

Computers can be used by terrorists to detonate bombs.

Computer professionals who take inappropriate actions when they encounter child pornography on their employer's systems can lose their jobs or break the law.

The author of a series of threatening e-mails consistently uses "im" instead of "I'm." This is an example of:

Personal computers and networks are often a valuable source of evidence. Those involved with _______ should be comfortable with this technology.

A logon record tells us that, at a specific time:

Why is it important for computer security professionals to become familiar with digital evidence?

Digital evidence can be duplicated exactly without any changes to the original data.

All forensic examinations should be performed on the original digital evidence.

Attorneys and police are encountering progressively more digital evidence in their work.

In terms of digital evidence, a Smart Card is an example of:

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters