Question 1

The decision to seize an entire computer versus create a forensic duplicate of the internal hard drive will be influenced by the role of the computer.

Accepted Answer

A) True 
 B)False

Question 2

The contents of volatile memory are becoming more and more important.

Accepted Answer

A) True 
 B)False

Question 3

What information would you provide when preparing a search warrant?

Accepted Answer

specific details of the items

Question 4

Digital investigators like to preserve every potential source of digital evidence; however, they are constrained by:

Accepted Answer

A)  The law 
B)  Resources 
C)  The interests of business 
D)  All of the above 
A)  The law 
B)  Resources 
C)  The interests of business 
D)  All of the above

Question 5

When a piece of evidence has both a biological and a digital component, who should process it first?

Accepted Answer

A)  The crime scene technician, because biological artifacts are much more fragile 
B)  The digital investigator, because processing the biological artifacts will destroy digital evidence 
C)  Neither; the evidence should be preserved and transported to the lab for processing 
D)  Both the crime scene technician and the digital investigator, in a cooperative effort, assuring that the biological evidence is collected in a way that does not damage the digital component 
A)  The crime scene technician, because biological artifacts are much more fragile 
B)  The digital investigator, because processing the biological artifacts will destroy digital evidence 
C)  Neither; the evidence should be preserved and transported to the lab for processing 
D)  Both the crime scene technician and the digital investigator, in a cooperative effort, assuring that the biological evidence is collected in a way that does not damage the digital component

Question 6

Which of the following is not a safety consideration for a first responder?

Accepted Answer

A)  Additional personnel to control those present at the crime scene 
B)  Protection against ELF emanations from monitors 
C)  Proper tools for disassembling and reassembling computer cases 
D)  Protective gloves and eyewear 
A)  Additional personnel to control those present at the crime scene 
B)  Protection against ELF emanations from monitors 
C)  Proper tools for disassembling and reassembling computer cases 
D)  Protective gloves and eyewear

Question 7

In most situations, it is advisable to let the physical crime scene technicians, under the direction of the forensic investigator, process the scene first.

Accepted Answer

A) True 
 B)False

Question 8

When seizing a computer, it is advisable to remove the computer's case and to unplug power cables from hard drives.

Accepted Answer

A) True 
 B)False

Question 9

On entering a crime scene, an investigator notes that a piece of equipment with antennas attached is connected to one of the target computers. Since this indicates a wireless connection, it is advisable to either disconnect or disable the piece of equipment.

Accepted Answer

A) True 
 B)False

Question 10

A thorough crime scene survey should include:

Accepted Answer

A)  Manuals for software applications 
B)  Removable media 
C)  Mobile devices 
D)  All of the above 
A)  Manuals for software applications 
B)  Removable media 
C)  Mobile devices 
D)  All of the above

Question 11

Computer security professionals should obtain instructions and written authorization from their attorneys before gathering digital evidence relating to an investigation with an organization.

Accepted Answer

A) True 
 B)False

Question 12

Why is the first step to secure the physical crime scene by removing everyone from the immediate area?

Accepted Answer

A)  To prevent them from contaminating evidence 
B)  To prevent them from asking questions about the case before they can be interviewed 
C)  To give them time to fill out a personal information survey 
D)  To keep them from blocking the view when photographs are being taken 
A)  To prevent them from contaminating evidence 
B)  To prevent them from asking questions about the case before they can be interviewed 
C)  To give them time to fill out a personal information survey 
D)  To keep them from blocking the view when photographs are being taken

The decision to seize an entire computer versus create a forensic duplicate of the internal hard drive will be influenced by the role of the computer.

The contents of volatile memory are becoming more and more important.

What information would you provide when preparing a search warrant?

Digital investigators like to preserve every potential source of digital evidence; however, they are constrained by:

When a piece of evidence has both a biological and a digital component, who should process it first?

Which of the following is not a safety consideration for a first responder?

In most situations, it is advisable to let the physical crime scene technicians, under the direction of the forensic investigator, process the scene first.

When seizing a computer, it is advisable to remove the computer's case and to unplug power cables from hard drives.

On entering a crime scene, an investigator notes that a piece of equipment with antennas attached is connected to one of the target computers. Since this indicates a wireless connection, it is advisable to either disconnect or disable the piece of equipment.

A thorough crime scene survey should include:

Computer security professionals should obtain instructions and written authorization from their attorneys before gathering digital evidence relating to an investigation with an organization.

Why is the first step to secure the physical crime scene by removing everyone from the immediate area?

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters

Exam 7: Handling a Digital Crime Scene

The decision to seize an entire computer versus create a forensic duplicate of the internal hard drive will be influenced by the role of the computer.

The contents of volatile memory are becoming more and more important.

What information would you provide when preparing a search warrant?

Digital investigators like to preserve every potential source of digital evidence; however, they are constrained by:

When a piece of evidence has both a biological and a digital component, who should process it first?

Which of the following is not a safety consideration for a first responder?

In most situations, it is advisable to let the physical crime scene technicians, under the direction of the forensic investigator, process the scene first.

When seizing a computer, it is advisable to remove the computer's case and to unplug power cables from hard drives.

On entering a crime scene, an investigator notes that a piece of equipment with antennas attached is connected to one of the target computers. Since this indicates a wireless connection, it is advisable to either disconnect or disable the piece of equipment.

A thorough crime scene survey should include:

Computer security professionals should obtain instructions and written authorization from their attorneys before gathering digital evidence relating to an investigation with an organization.

Why is the first step to secure the physical crime scene by removing everyone from the immediate area?

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters