Exam 7: Handling a Digital Crime Scene

When an organization itself is under investigation, it is always feasible to collect all the data for every system.

During the initial survey of a crime scene, why it is necessary to photograph or videotape the area and items of potential interest in their current state?

Since crime scenes are typically pretty much the same, very little planning needs to take place prior to first entering the scene.

The crime scene preservation process includes all but which of the following:

When a first responder encounters technology or equipment that he is not familiar with, the recommended course of action is to:

When performing triage at a crime scene, an important first step is to turn on any computers that are off and immediately look for items of evidence.

The likelihood of collecting notable information from a running computer is relatively small, so it is safe to shut down any running computer to preserve the data on the hard drive.

Examples of data that should be immediately preserved include:

What considerations are there when developing a crime scene plan?

When entering a crime scene, the initial survey should:

When preparing a questionnaire for interviewing individuals of the crime scene which of the following should NOT be requested:

The proper collection of evidence at a crime scene is crucial in terms of admissibility in court.

When first entering a crime scene, the first responder should immediately focus on the computers and technology.

In the case where digital investigators dealing with distributed systems need to collect data from remote sites, the following procedure is recommended:

The following organizations have published guidelines for handling digital crime scenes:

The challenge to controlling access to a digital crime scene is that:

When shutting down a live system it is generally recommended to unplug the power from the back of the computer.

The Fourth Amendment, like ECPA, only applies to the government, not the private sector.

When presenting evidence on an organizational network, the digital investigator may require the assistance of:

Capturing volatile data or specific files from a live system is a straightforward process usually handled by the first responder.