Question 1

There is no need for any specialized training in the collection of digital evidence.

Accepted Answer

A) True 
 B)False  False

Question 2

Evidence contained in a document provided to prove that statements made in court are true is referred to as:

Accepted Answer

A)  Inadmissible evidence 
B)  Illegally obtained evidence 
C)  Hearsay evidence 
D)  Direct evidence 
A)  Inadmissible evidence 
B)  Illegally obtained evidence 
C)  Hearsay evidence 
D)  Direct evidence C

Question 3

The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:

Accepted Answer

A)  Chain of custody 
B)  Field notes 
C)  Interim report 
D)  None of the above 
A)  Chain of custody 
B)  Field notes 
C)  Interim report 
D)  None of the above A

Question 4

Having a member of the search team trained to handle digital evidence:

Accepted Answer

A)  Can reduce the number of people who handle the evidence 
B)  Can serve to streamline the presentation of the case 
C)  Can reduce the opportunity for opposing counsel to impugn the integrity of the evidence 
D)  All of the above 
A)  Can reduce the number of people who handle the evidence 
B)  Can serve to streamline the presentation of the case 
C)  Can reduce the opportunity for opposing counsel to impugn the integrity of the evidence 
D)  All of the above

Question 5

Chain of custody is the process of documenting who has handled evidence, where and when, as it travels from the crime scene to the courts.

Accepted Answer

A) True 
 B)False

Question 6

During testimony, when a lawyer appears not to be tech savvy, it is a good practice to guess what the attorney is trying to ask.

Accepted Answer

A) True 
 B)False

Question 7

The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:

Accepted Answer

A)  Best evidence rule 
B)  Due diligence 
C)  Quid pro quo 
D)  Voir dire 
A)  Best evidence rule 
B)  Due diligence 
C)  Quid pro quo 
D)  Voir dire

Question 8

Typically, a photocopy of a document is considered hearsay evidence and is not admissible in court.

Accepted Answer

A) True 
 B)False

Question 9

The application of preconceived theories to a particular case is a good method of reducing caseload.

Accepted Answer

A) True 
 B)False

Question 10

Determining whether digital evidence has been tampered with is a major concern of the digital examiner.

Accepted Answer

A) True 
 B)False

Question 11

Regarding the admissibility of evidence, which of the following is not a consideration:

Accepted Answer

A)  Relevance 
B)  Authenticity 
C)  Best evidence 
D)  Nominally prejudicial 
A)  Relevance 
B)  Authenticity 
C)  Best evidence 
D)  Nominally prejudicial

Question 12

According to the text, the most common mistake that prevents evidence seized from being admitted is:

Accepted Answer

A)  Uninformed consent 
B) Obtained without authorization 
C)  None of the above 
A)  Uninformed consent 
B) Obtained without authorization 
C)  None of the above

Question 13

A digital investigator pursuing a line of investigation in a case because that line of investigation proved successful in two previous cases is an example of:

Accepted Answer

A)  Logical reasoning 
B)  Common sense 
C)  Preconceived theory 
D)  Investigator's intuition 
A)  Logical reasoning 
B)  Common sense 
C)  Preconceived theory 
D)  Investigator's intuition

Question 14

Voir dire is the process of becoming accepted as an expert by the court.

Accepted Answer

A) True 
 B)False

Question 15

Business records are considered to be an exception to:

Accepted Answer

A)  Direct evidence 
B)  Inadmissible evidence 
C)  Illegally obtained evidence 
D)  Hearsay evidence 
A)  Direct evidence 
B)  Inadmissible evidence 
C)  Illegally obtained evidence 
D)  Hearsay evidence

Question 16

It is the duty of a digital investigator to ignore influences from any source.

Accepted Answer

A) True 
 B)False

Question 17

Direct evidence establishes a fact.

Accepted Answer

A) True 
 B)False

Question 18

When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:

Accepted Answer

A)  Whether chain of custody was maintained 
B)  Whether there are indications that the actual digital evidence was tampered with 
C)  Whether the evidence was properly secured in transit 
D)  Whether the evidence media was compatible with forensic machines 
A)  Whether chain of custody was maintained 
B)  Whether there are indications that the actual digital evidence was tampered with 
C)  Whether the evidence was properly secured in transit 
D)  Whether the evidence media was compatible with forensic machines

Question 19

Digital evidence cannot be direct evidence because of its separation from the events it represents.

Accepted Answer

A) True 
 B)False

Question 20

Direct evidence establishes a:

Accepted Answer

A)  Fact 
B)  Assumption 
C)  Error 
D)  Line of inquiry 
A)  Fact 
B)  Assumption 
C)  Error 
D)  Line of inquiry

Exam 3: Digital Evidence in the Courtroom

There is no need for any specialized training in the collection of digital evidence.

Evidence contained in a document provided to prove that statements made in court are true is referred to as:

The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:

Having a member of the search team trained to handle digital evidence:

Chain of custody is the process of documenting who has handled evidence, where and when, as it travels from the crime scene to the courts.

During testimony, when a lawyer appears not to be tech savvy, it is a good practice to guess what the attorney is trying to ask.

The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:

Typically, a photocopy of a document is considered hearsay evidence and is not admissible in court.

The application of preconceived theories to a particular case is a good method of reducing caseload.

Determining whether digital evidence has been tampered with is a major concern of the digital examiner.

Regarding the admissibility of evidence, which of the following is not a consideration:

According to the text, the most common mistake that prevents evidence seized from being admitted is:

A digital investigator pursuing a line of investigation in a case because that line of investigation proved successful in two previous cases is an example of:

Voir dire is the process of becoming accepted as an expert by the court.

Business records are considered to be an exception to:

It is the duty of a digital investigator to ignore influences from any source.

Direct evidence establishes a fact.

When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:

Digital evidence cannot be direct evidence because of its separation from the events it represents.

Direct evidence establishes a:

Foundations of Digital Forensics

Language of Computer Crime Investigation

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters