Question 1

Forensic analysis involves the following:

Accepted Answer

A)  Assessment, experimentation, fusion, correlation, and validation 
B)  Seizure and preservation 
C)  Recovery, harvesting, filtering, organization, and search 
D)  All of the above 
A)  Assessment, experimentation, fusion, correlation, and validation 
B)  Seizure and preservation 
C)  Recovery, harvesting, filtering, organization, and search 
D)  All of the above A

Question 2

Evidential artifacts found in the experimentation and testing process of the scientific method which are compatible with a particular hypothesis can be taken as proof of the hypothesis.

Accepted Answer

A) True 
 B)False  False

Question 3

Forensic examination and forensic analysis are separate processes.

Accepted Answer

A) True 
 B)False  True

Question 4

When a network is involved in a crime, investigators must seize and preserve all systems on the network.

Accepted Answer

A) True 
 B)False

Question 5

Why is it important to process digital evidence properly while conducting an investigation?

Accepted Answer

Proper evidence processing is essential

Question 6

The goal of an investigation is to:

Accepted Answer

A)  Convict the suspect 
B)  Discover the truth 
C)  Find incriminating evidence 
D)  All of the above 
A)  Convict the suspect 
B)  Discover the truth 
C)  Find incriminating evidence 
D)  All of the above

Question 7

Survey/triage forensic inspection is the targeted review of all available media to determine which items contain the most useful evidence and require additional processing.

Accepted Answer

A) True 
 B)False

Question 8

When you have developed a theory, what can you do to confirm that your hypothesis is correct?

Accepted Answer

A)  Predict, based on your hypothesis, where artifacts should be located 
B)  Perform experiments to test results and rule out alternate explanations 
C)  Conclude, based on your findings, whether the evidence supports the hypothesis 
D)  All of the above 
A)  Predict, based on your hypothesis, where artifacts should be located 
B)  Perform experiments to test results and rule out alternate explanations 
C)  Conclude, based on your findings, whether the evidence supports the hypothesis 
D)  All of the above

Question 9

When digital photographs containing child pornography are found on a home computer, investigators can assert that:

Accepted Answer

A)  Someone in the house transferred the photographs onto the computer from a disk or the Internet. 
B)  Someone in the house took the photographs with a digital camera and transferred them directly onto the computer. 
C)  Someone gained unauthorized access to the computer via the Internet and transferred the photographs onto the computer. 
D)  None of the above. 
A)  Someone in the house transferred the photographs onto the computer from a disk or the Internet. 
B)  Someone in the house took the photographs with a digital camera and transferred them directly onto the computer. 
C)  Someone gained unauthorized access to the computer via the Internet and transferred the photographs onto the computer. 
D)  None of the above.

Question 10

Generating a plan of action and obtaining supporting resources and materials falls under which step in the digital investigation?

Accepted Answer

A)  Preparation 
B)  Survey/identification 
C)  Preservation 
D)  Examination and analysis 
A)  Preparation 
B)  Survey/identification 
C)  Preservation 
D)  Examination and analysis

Question 11

What is Locard's Exchange Principle? Give an example of how this principle applies to computer crime.

Accepted Answer

Locard's Exchange Principle is one of th

Question 12

Preparation for the preservation step ensures that the best evidence can be preserved when the opportunity arises.

Accepted Answer

A) True 
 B)False

Question 13

Forensic examination is the process of extracting, viewing, and analyzing information from the evidence collected.

Accepted Answer

A) True 
 B)False

Question 14

Not all incidents should be fully investigated nor do they all deserve the same priority and attention.

Accepted Answer

A) True 
 B)False

Question 15

Standard operating procedures (SOPs) are important because they:

Accepted Answer

A)  Help individuals avoid common mistakes 
B)  Ensure that the best available methods are used 
C)  Increase the probability that two forensic examiners will reach the same conclusions when they examine the evidence 
D)  All of the above 
A)  Help individuals avoid common mistakes 
B)  Ensure that the best available methods are used 
C)  Increase the probability that two forensic examiners will reach the same conclusions when they examine the evidence 
D)  All of the above

Question 16

In the Staircase Model, why is case management shown spanning across all of the steps in the process model?

Accepted Answer

A)  Case documents are intangible objects that can be held. 
B)  Case management provides stability and enables investigators to tie all relevant information together. 
C)  Case management documents the process function. 
D)  None of the above. 
A)  Case documents are intangible objects that can be held. 
B)  Case management provides stability and enables investigators to tie all relevant information together. 
C)  Case management documents the process function. 
D)  None of the above.

Question 17

The legal truth is always in agreement with the scientific truth in an investigation.

Accepted Answer

A) True 
 B)False

Question 18

The first step in applying the scientific method to a digital investigation is to:

Accepted Answer

A)  Form a theory on what may have occurred 
B)  Experiment or test the available evidence to confirm or refute your prediction 
C)  Make one or more observations based on events that occurred 
D)  Form a conclusion based on the results of your findings 
A)  Form a theory on what may have occurred 
B)  Experiment or test the available evidence to confirm or refute your prediction 
C)  Make one or more observations based on events that occurred 
D)  Form a conclusion based on the results of your findings

Question 19

Which of the following should the digital investigator consider when arranging for the transportation of evidence?

Accepted Answer

A)  Should the evidence be physically in the possession of the investigator at all times? 
B)  Will the evidence copies be shared with other experts at other locations? 
C)  Will there be environmental factors associated with the digital media? 
D)  All of the above 
A)  Should the evidence be physically in the possession of the investigator at all times? 
B)  Will the evidence copies be shared with other experts at other locations? 
C)  Will there be environmental factors associated with the digital media? 
D)  All of the above

Question 20

If alternative theories are suggested later, digital investigators have an obligation to reevaluate their findings.

Accepted Answer

A) True 
 B)False

Exam 6: Conducting Digital Investigations

Forensic analysis involves the following:

Evidential artifacts found in the experimentation and testing process of the scientific method which are compatible with a particular hypothesis can be taken as proof of the hypothesis.

Forensic examination and forensic analysis are separate processes.

When a network is involved in a crime, investigators must seize and preserve all systems on the network.

Why is it important to process digital evidence properly while conducting an investigation?

The goal of an investigation is to:

Survey/triage forensic inspection is the targeted review of all available media to determine which items contain the most useful evidence and require additional processing.

When you have developed a theory, what can you do to confirm that your hypothesis is correct?

When digital photographs containing child pornography are found on a home computer, investigators can assert that:

Generating a plan of action and obtaining supporting resources and materials falls under which step in the digital investigation?

What is Locard's Exchange Principle? Give an example of how this principle applies to computer crime.

Preparation for the preservation step ensures that the best evidence can be preserved when the opportunity arises.

Forensic examination is the process of extracting, viewing, and analyzing information from the evidence collected.

Not all incidents should be fully investigated nor do they all deserve the same priority and attention.

Standard operating procedures (SOPs) are important because they:

In the Staircase Model, why is case management shown spanning across all of the steps in the process model?

The legal truth is always in agreement with the scientific truth in an investigation.

The first step in applying the scientific method to a digital investigation is to:

Which of the following should the digital investigator consider when arranging for the transportation of evidence?

If alternative theories are suggested later, digital investigators have an obligation to reevaluate their findings.

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters