Question 1

Digital evidence is always circumstantial.

Accepted Answer

A) True 
 B)False

Question 2

What is the difference between digital evidence, electronic evidence, and computer evidence?

Accepted Answer

Computer evidence and electron

Question 3

In terms of digital evidence, a mobile telephone is an example of:

Accepted Answer

A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above 
A)  Open computer systems 
B)  Communication systems 
C)  Embedded computer systems 
D)  None of the above

Question 4

In terms of digital evidence, a hard drive is an example of:
a. Open computer systems
b. Communication systems
c. Embedded computer systems
d. None of the above

Accepted Answer

Open compu

Question 5

Computers can be involved in which of the following types of crime?

Accepted Answer

A)  Homicide and sexual assault 
B)  Computer intrusions and intellectual property theft 
C)  Civil disputes 
D)  All of the above 
A)  Homicide and sexual assault 
B)  Computer intrusions and intellectual property theft 
C)  Civil disputes 
D)  All of the above

Question 6

Digital evidence is only useful in a court of law.

Accepted Answer

A) True 
 B)False

Question 7

At what point should computer security professionals stop handling digital evidence and contact law enforcement?

Accepted Answer

This is a difficult question that requir

Question 8

Cybertrails are advantageous because:

Accepted Answer

A)  They are not connected to the physical world. 
B)  Nobody can be harmed by crime on the Internet. 
C)  They are easy to follow. 
D)  Offenders who are unaware of them leave behind more clues than they otherwise would have. 
A)  They are not connected to the physical world. 
B)  Nobody can be harmed by crime on the Internet. 
C)  They are easy to follow. 
D)  Offenders who are unaware of them leave behind more clues than they otherwise would have.

Question 9

Even digital investigations that do not result in legal action can benefit from principles of forensic science.

Accepted Answer

A) True 
 B)False

Question 10

A valid definition of digital evidence is:

Accepted Answer

A)  Data stored or transmitted using a computer 
B)  Information of probative value 
C)  Digital data of probative value 
D)  Any digital evidence on a computer 
A)  Data stored or transmitted using a computer 
B)  Information of probative value 
C)  Digital data of probative value 
D)  Any digital evidence on a computer

Question 11

Computers were involved in the investigations into both World Trade Center attacks.

Accepted Answer

A) True 
 B)False

Question 12

What are the three general categories of computer systems that can contain digital evidence? In each category, give a specific source of digital evidence that interests you and describe the type of evidence that you might find.

Accepted Answer

Open systems, communication systems, and

Question 13

An argument for including computer forensic training computer security specialists is:

Accepted Answer

A)  It provide s an a ddit i onal credential. 
B)  It provide s the m wit h the t ool s to conduct their own i nvesti g ations. 
C)  It teaches them wh en it is ti me to call in law enforcement. 
D)  N o ne of the above. 
A)  It provide s an a ddit i onal credential. 
B)  It provide s the m wit h the t ool s to conduct their own i nvesti g ations. 
C)  It teaches them wh en it is ti me to call in law enforcement. 
D)  N o ne of the above.

Question 14

When criminals use computers, what advantages does this have from an investigative standpoint?

Accepted Answer

1) Computer activities leave trails/onli

Question 15

Private networks can be a richer source of evidence than the Internet because:

Accepted Answer

A)  They retain data for longer periods of time. 
B)  Owners of private networks are more cooperative with law enforcement. 
C)  Private networks contain a higher concentration of digital evidence. 
D)  All of the above. 
A)  They retain data for longer periods of time. 
B)  Owners of private networks are more cooperative with law enforcement. 
C)  Private networks contain a higher concentration of digital evidence. 
D)  All of the above.

Question 16

The criminological principle which states that, when anyone, or anything, enters a crime scene he/she takes something of the scene with him/her, and leaves something of himself/herself behind, is:

Accepted Answer

A)  Locard's Exchange Principle 
B)  Differential Association Theory 
C)  Beccaria's Social Contract 
D)  None of the above 
A)  Locard's Exchange Principle 
B)  Differential Association Theory 
C)  Beccaria's Social Contract 
D)  None of the above

Exam 1: Foundations of Digital Forensics

Digital evidence is always circumstantial.

What is the difference between digital evidence, electronic evidence, and computer evidence?

In terms of digital evidence, a mobile telephone is an example of:

In terms of digital evidence, a hard drive is an example of: a. Open computer systems b. Communication systems c. Embedded computer systems d. None of the above

Computers can be involved in which of the following types of crime?

Digital evidence is only useful in a court of law.

At what point should computer security professionals stop handling digital evidence and contact law enforcement?

Cybertrails are advantageous because:

Even digital investigations that do not result in legal action can benefit from principles of forensic science.

A valid definition of digital evidence is:

Computers were involved in the investigations into both World Trade Center attacks.

What are the three general categories of computer systems that can contain digital evidence? In each category, give a specific source of digital evidence that interests you and describe the type of evidence that you might find.

An argument for including computer forensic training computer security specialists is:

When criminals use computers, what advantages does this have from an investigative standpoint?

Private networks can be a richer source of evidence than the Internet because:

The criminological principle which states that, when anyone, or anything, enters a crime scene he/she takes something of the scene with him/her, and leaves something of himself/herself behind, is:

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters