Exam 16: Applying Forensic Science to Computers

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

A sound forensic practice is to make at least two copies of digital evidence and to confirm that at least one of the copies was successful and can be accessed on another computer.

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

At a crime scene, digital evidence will be found on the computer, on mobile devices, and on shelves, bookcases, and the area surrounding the computer. Therefore, there is no need to search the garbage for evidence.

The updated ACPO recommendation for seizing a running computer is to pull the electrical cord from the back of the computer.

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?

Which of the following is NOT one of the recommended approaches to preserving digital evidence?

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

Under independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, a reasonable compromise is to duplicate the

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.

"dd" is the only way to make a bitstream copy.