Question 1

Absence of evidence refutes an alibi.

Accepted Answer

A) True 
 B)False  False

Question 2

Types of digital evidence that might corroborate an alibi include:

Accepted Answer

A)  Evidence of computer usage when the offense was supposed to occurred 
B)  Computer records from credit cards, the telephone company, or subway ticket usage 
C)  GPS information from mobile devices indicating the user's location and time 
D)  All of the above 
A)  Evidence of computer usage when the offense was supposed to occurred 
B)  Computer records from credit cards, the telephone company, or subway ticket usage 
C)  GPS information from mobile devices indicating the user's location and time 
D)  All of the above D

Question 3

Credit card companies are not permitted to keep records of the dates, times, and locations of all purchases.

Accepted Answer

A) True 
 B)False  False

Question 4

Investigators can rely on one piece of digital evidence when examining an alibi.

Accepted Answer

A) True 
 B)False

Question 5

To demonstrate that someone is lying about an alibi, it is necessary to:

Accepted Answer

A)  Find evidence that clearly demonstrates the lie 
B)  Require the suspect to submit to a polygraph 
C)  Interrogate the suspect using a number of methods 
D)  Show that no evidence confirming the alibi is available 
A)  Find evidence that clearly demonstrates the lie 
B)  Require the suspect to submit to a polygraph 
C)  Interrogate the suspect using a number of methods 
D)  Show that no evidence confirming the alibi is available

Question 6

It is not easy to change the time on a personal computer.

Accepted Answer

A) True 
 B)False

Question 7

Digital evidence can rarely prove conclusively that someone was at a specific place at a specific time.

Accepted Answer

A) True 
 B)False

Question 8

Computer networks can contain a large amount of information about times and locations.

Accepted Answer

A) True 
 B)False

Question 9

It is not difficult to fabricate an alibi on a network successfully.

Accepted Answer

A) True 
 B)False

Question 10

Investigators should not rely on one piece of digital evidence when examining an alibi - they should look for an associated__________ .

Accepted Answer

A)  Cybertrail 
B)  Piece of physical evidence 
C)  Statement 
D)  None of the above 
A)  Cybertrail 
B)  Piece of physical evidence 
C)  Statement 
D)  None of the above

Question 11

Discuss the reasons why a digital investigator would confirm an alibi. Isn't that a job for the suspect's defense counsel?

Accepted Answer

The digital investig

Question 12

Telephone companies keep a record of the number, the time and duration of the call, and sometimes the caller's number.

Accepted Answer

A) True 
 B)False

Question 13

In confirming an alibi involving an obscure piece of equipment, if no documentation is available, the manufacturer is no longer in business, or the equipment/network is so complicated that nobody fully understands how it works, you should:

Accepted Answer

A)  State that the alibi is considered unproven 
B)  Search the Internet for any pertinent information 
C)  Recreate the events surrounding the alibi 
D)  Contact other investigators and average their opinions 
A)  State that the alibi is considered unproven 
B)  Search the Internet for any pertinent information 
C)  Recreate the events surrounding the alibi 
D)  Contact other investigators and average their opinions

Question 14

It is important to gather as many sources of supporting evidence as possible because:

Accepted Answer

A)  The more evidence, the stronger the case. 
B)  No amount of supporting evidence can prove conclusively that an individual was in a specific place at a specific time. 
C)  The volume of evidence produced dictates the strength of the alibi. 
D)  None of the above. 
A)  The more evidence, the stronger the case. 
B)  No amount of supporting evidence can prove conclusively that an individual was in a specific place at a specific time. 
C)  The volume of evidence produced dictates the strength of the alibi. 
D)  None of the above.

Question 15

It is unwise to rely only on a recovered IP address because:

Accepted Answer

A)  An IP address may change many times during a session. 
B)  Offenders can change their IP address. 
C)  By changing the system time, the contents of log files containing IP addresses can be falsified. 
D)  IP addresses only exist in system memory. 
A)  An IP address may change many times during a session. 
B)  Offenders can change their IP address. 
C)  By changing the system time, the contents of log files containing IP addresses can be falsified. 
D)  IP addresses only exist in system memory.

Question 16

When investigating an alibi that depends on digital evidence, the first step is to assess the reliability of the information on the computers and networks involved.

Accepted Answer

A) True 
 B)False

Question 17

It is quite difficult to fabricate an alibi on a network successfully because:

Accepted Answer

A)  An offender may not have the proper access. 
B)  An offender would need system administrator access level to make the necessary changes. 
C)  An individual rarely has the ability to falsify digital evidence on all the computers that are involved. 
D)  Creating an alibi on a network could take months of work. 
A)  An offender may not have the proper access. 
B)  An offender would need system administrator access level to make the necessary changes. 
C)  An individual rarely has the ability to falsify digital evidence on all the computers that are involved. 
D)  Creating an alibi on a network could take months of work.

Question 18

With people spending an increasing amount of time using mobile devices, computers, and networks, it is very likely that more alibis will depend on digital evidence.

Accepted Answer

A) True 
 B)False

Exam 11: Digital Evidence As Alibi

Absence of evidence refutes an alibi.

Types of digital evidence that might corroborate an alibi include:

Credit card companies are not permitted to keep records of the dates, times, and locations of all purchases.

Investigators can rely on one piece of digital evidence when examining an alibi.

To demonstrate that someone is lying about an alibi, it is necessary to:

It is not easy to change the time on a personal computer.

Digital evidence can rarely prove conclusively that someone was at a specific place at a specific time.

Computer networks can contain a large amount of information about times and locations.

It is not difficult to fabricate an alibi on a network successfully.

Investigators should not rely on one piece of digital evidence when examining an alibi - they should look for an associated__________ .

Discuss the reasons why a digital investigator would confirm an alibi. Isn't that a job for the suspect's defense counsel?

Telephone companies keep a record of the number, the time and duration of the call, and sometimes the caller's number.

In confirming an alibi involving an obscure piece of equipment, if no documentation is available, the manufacturer is no longer in business, or the equipment/network is so complicated that nobody fully understands how it works, you should:

It is important to gather as many sources of supporting evidence as possible because:

It is unwise to rely only on a recovered IP address because:

When investigating an alibi that depends on digital evidence, the first step is to assess the reliability of the information on the computers and networks involved.

It is quite difficult to fabricate an alibi on a network successfully because:

With people spending an increasing amount of time using mobile devices, computers, and networks, it is very likely that more alibis will depend on digital evidence.

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters