Question 1

By default, computers will boot from a floppy disk if one is present in the system.

Accepted Answer

A) True 
 B)False  False

Question 2

The BIOS can be password protected.

Accepted Answer

A) True 
 B)False  True

Question 3

On Intel-based computers, system date and time information is maintained in:

Accepted Answer

A)  CMOS 
B)  System.conf 
C)  MBR 
D)  Boot record 
A)  CMOS 
B)  System.conf 
C)  MBR 
D)  Boot record A

Question 4

Many digital forensics laboratories have the capability to recover overwritten data from a hard drive.

Accepted Answer

A) True 
 B)False

Question 5

The number of sectors on any hard drive is calculated by multiplying its CHS values.

Accepted Answer

A) True 
 B)False

Question 6

The CMOS RAM chip stores a computer's date and time.

Accepted Answer

A) True 
 B)False

Question 7

Sectors are 557 bytes long but only 512 bytes are used to store data.

Accepted Answer

A) True 
 B)False

Question 8

Describe the main steps that your computer takes during the boot process from the time you press the power switch to the first appearance of the operating system. Why is this important to a forensic examiner?

Accepted Answer

The main steps that a computer takes to

Question 9

Which encryption scheme is weakest?

Accepted Answer

A)  RSA 
B)  ROT13 
C)  DES 
D)  DSA 
A)  RSA 
B)  ROT13 
C)  DES 
D)  DSA

Question 10

The Sun OpenBoot PROM can be interrupted by depressing the "Stop" key.

Accepted Answer

A) True 
 B)False

Question 11

The first sector of a hard disk contains a:

Accepted Answer

A)  Boot sector 
B)  Master boot record 
C)  Volume 
D)  Partition 
A)  Boot sector 
B)  Master boot record 
C)  Volume 
D)  Partition

Question 12

What is the storage capacity of a hard drive with 64 heads, 63 sectors, and 787 cylinders?

Accepted Answer

64 × 63 × 787 = 3,17

Question 13

Encrypted data can be recovered using which of the following methods?

Accepted Answer

A)  Trying every possible encryption key 
B)  Obtaining the passphrase used to protect the encryption key 
C)  Recovering plaintext versions of data from unallocated and slack space 
D)  All of the above 
A)  Trying every possible encryption key 
B)  Obtaining the passphrase used to protect the encryption key 
C)  Recovering plaintext versions of data from unallocated and slack space 
D)  All of the above

Question 14

Although storage media come in many forms, hard disks are the richest sources of digital evidence on computers.

Accepted Answer

A) True 
 B)False

Question 15

How many bytes are in a kilobyte?

Accepted Answer

A)  8 
B)  100 
C)  1000 
D)  1024 
A)  8 
B)  100 
C)  1000 
D)  1024

Question 16

How do you remove data from a hard drive to prevent it from being recovered (e.g., delete partition table, reformat drive, delete files)?

Accepted Answer

Although a low-level format effectively

Question 17

Digital forensics examiners do not need to be concerned about the distinction between little-endian and big-endian representations because automated tools make the necessary translation.

Accepted Answer

A) True 
 B)False

Question 18

The storage capacity of a hard drive with 256 heads, 63 sectors, and 1024 cylinders is:

Accepted Answer

A)  8.4 Gbytes 
B)  7.8 Gbytes 
C)  8 Gbytes 
D)  9 Gbytes 
A)  8.4 Gbytes 
B)  7.8 Gbytes 
C)  8 Gbytes 
D)  9 Gbytes

Question 19

The big-endian representation of "FB 78 7A 23" is:

Accepted Answer

A)  78 FB 23 7A 
B)  7A 23 FB 78 
C)  23 7A 78 FB 
D)  FB 7A 78 23 
A)  78 FB 23 7A 
B)  7A 23 FB 78 
C)  23 7A 78 FB 
D)  FB 7A 78 23

Question 20

Solaris computers store data in:

Accepted Answer

A)  Hexadecimal 
B)  Little-endian 
C)  Octal 
D)  Big-endian 
A)  Hexadecimal 
B)  Little-endian 
C)  Octal 
D)  Big-endian

Exam 15: Computer Basics for Digital Investigators

By default, computers will boot from a floppy disk if one is present in the system.

The BIOS can be password protected.

On Intel-based computers, system date and time information is maintained in:

Many digital forensics laboratories have the capability to recover overwritten data from a hard drive.

The number of sectors on any hard drive is calculated by multiplying its CHS values.

The CMOS RAM chip stores a computer's date and time.

Sectors are 557 bytes long but only 512 bytes are used to store data.

Describe the main steps that your computer takes during the boot process from the time you press the power switch to the first appearance of the operating system. Why is this important to a forensic examiner?

Which encryption scheme is weakest?

The Sun OpenBoot PROM can be interrupted by depressing the "Stop" key.

The first sector of a hard disk contains a:

What is the storage capacity of a hard drive with 64 heads, 63 sectors, and 787 cylinders?

Encrypted data can be recovered using which of the following methods?

Although storage media come in many forms, hard disks are the richest sources of digital evidence on computers.

How many bytes are in a kilobyte?

How do you remove data from a hard drive to prevent it from being recovered (e.g., delete partition table, reformat drive, delete files)?

Digital forensics examiners do not need to be concerned about the distinction between little-endian and big-endian representations because automated tools make the necessary translation.

The storage capacity of a hard drive with 256 heads, 63 sectors, and 1024 cylinders is:

The big-endian representation of "FB 78 7A 23" is:

Solaris computers store data in:

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters