Exam 8: Investigative Reconstruction With Digital Evidence

One of the most important things to establish when a computer is directly involved in the commission of a crime is:

When assessing the risk of a target computer, investigators should determine if the offender needed a high level of skill.

An example of online behavior that puts an individual at higher risk for cyberstalking is:

Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?

The machine with an old operating system, no patches, and many services running, located on an unprotected network, containing valuable information, and with a history of intrusions or intrusion attempts, is at low risk of being broken into.

The investigation and study of victim characteristics is known as:

When a computer is the target of an attack, it is also useful to determine if the system was at high or low risk of being targeted.

Victimology is the investigation and study of victim characteristics.

The temporal form of investigative reconstruction helps identify event sequences and patterns.

A threshold assessment report may have a similar structure to a full investigative report but includes more details and has firmer conclusions based on all the evidence available.

Threshold assessments have eliminated the need for digital investigators to write full reports.

Although it is possible that the Internet can significantly increase the victim's risk, it is not necessary for victimology to include a thorough search for cybertrails.

The process of evaluating available evidence objectively, independent of the interpretations of others, to determine its true meaning is referred to as:

Forensic analysis and reconstruction only include evidence that was left at a crime scene and are intrinsically limited.

Because seemingly minor details regarding the offender can be important, investigators should get into the habit of contemplating which of the following:

In the movie Home Alone one of the burglars would always turn the water on in the sinks so that the house would be flooded when the owners returned. In terms of crime scene characteristics, this is an example of:

The functional form of investigative reconstruction answers the questions "Who?" "What?" and "Where?"

Different offenders can use the same method of approach for control for very different reasons; however, it is possible to make reliable generations on the basis of individual crime scene characteristics.

Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?

Among the more informative aspects of the offender-victim relationships are victim risk and the effort than an offender was willing to make to access a specific victim.