Question 1

Web Whacker and Httrack are examples of tools that:

Accepted Answer

A)  Search the Web 
B)  Deface websites 
C)  Capture websites 
D)  Launch websites 
A)  Search the Web 
B)  Deface websites 
C)  Capture websites 
D)  Launch websites C

Question 2

Which of the following Internet services can be used to exchange illegal materials?

Accepted Answer

A)  IRC 
B)  Usenet 
C)  KaZaa 
D)  All of the above 
A)  IRC 
B)  Usenet 
C)  KaZaa 
D)  All of the above D

Question 3

It is not possible to decrypt and view captured network traffic.

Accepted Answer

A) True 
 B)False  False

Question 4

The cybertrail is only useful for gathering information about an offender, not a victim.

Accepted Answer

A) True 
 B)False

Question 5

What peer-to-peer clients use the Fast Track network?

Accepted Answer

A)  KaZaA 
B)  Grokster 
C)  iMesh 
D)  All of the above 
A)  KaZaA 
B)  Grokster 
C)  iMesh 
D)  All of the above

Question 6

Whois databases contain contact information relating to IP addresses but not domain names.

Accepted Answer

A) True 
 B)False

Question 7

What are two of the most useful headers for determining the origination of Usenet messages?

Accepted Answer

A)  From and Message-ID 
B)  NNTP-Posting-Host and X-Trace 
C)  Path and Subject 
D)  RFC1036 and RFC2980 
A)  From and Message-ID 
B)  NNTP-Posting-Host and X-Trace 
C)  Path and Subject 
D)  RFC1036 and RFC2980

Question 8

Given the wealth of information that social networks contain, digital investigators will often find useful information at these sites.

Accepted Answer

A) True 
 B)False

Question 9

Posting information online takes control of the information away from the person and such information can remain online indefinitely.

Accepted Answer

A) True 
 B)False

Question 10

Which of the following applications leave traces of Internet activities on a personal computer?

Accepted Answer

A)  Internet Explorer 
B)  KaZaA 
C)  IRC 
D)  All of the above 
A)  Internet Explorer 
B)  KaZaA 
C)  IRC 
D)  All of the above

Question 11

When you access a web page, the content may be located on a server other than the one you accessed.

Accepted Answer

A) True 
 B)False

Question 12

What information should you document when searching for evidence on the Web?

Accepted Answer

A)  Date/time of search, search engine and terms used, address of pertinent results 
B)  Screenshots of significant search results 
C)  Download copies of the webpages and calculate their MD5 value 
D)  All of the above 
A)  Date/time of search, search engine and terms used, address of pertinent results 
B)  Screenshots of significant search results 
C)  Download copies of the webpages and calculate their MD5 value 
D)  All of the above

Question 13

The "invisible Web" can only be accessed by government employees.

Accepted Answer

A) True 
 B)False

Question 14

Criminals let their guard down in chat networks because they feel protected by the perceived anonymity.

Accepted Answer

A) True 
 B)False

Question 15

Metaverseink is a:

Accepted Answer

A)  Search tool (people or things) for virtual worlds 
B)  Newsgroup aggregator 
C)  Social networking meta-tool 
D)  A file-sharing peer-to-peer network 
A)  Search tool (people or things) for virtual worlds 
B)  Newsgroup aggregator 
C)  Social networking meta-tool 
D)  A file-sharing peer-to-peer network

Question 16

When evidence is located on the Internet, investigators should document and preserve it immediately or it may be gone the next time they look for it.

Accepted Answer

A) True 
 B)False

Question 17

Second Life is one of the better known:

Accepted Answer

A)  Research websites 
B)  Archive websites 
C)  Virtual worlds 
D)  Web-based game shows 
A)  Research websites 
B)  Archive websites 
C)  Virtual worlds 
D)  Web-based game shows

Question 18

The Web archive (web.archive.org) contains a complete and accurate copy of web pages as they existed at a particular time.

Accepted Answer

A) True 
 B)False

Question 19

Which of the following enables a user to connect to IRC and run IRC fserves without disclosing their IP address?

Accepted Answer

A)  Freenet 
B)  psybnc bot 
C)  Fserve 
D)  All of the above 
A)  Freenet 
B)  psybnc bot 
C)  Fserve 
D)  All of the above

Question 20

Why is it important to hide your identity when conducting an online investigation?

Accepted Answer

A)  To reduce the risk of alerting the offender 
B)  To get yourself in the mindset of covert web investigating 
C)  To make it easier for you to determine the offender's location 
D)  All of the above 
A)  To reduce the risk of alerting the offender 
B)  To get yourself in the mindset of covert web investigating 
C)  To make it easier for you to determine the offender's location 
D)  All of the above

Exam 23: Digital Evidence on the Internet

Web Whacker and Httrack are examples of tools that:

Which of the following Internet services can be used to exchange illegal materials?

It is not possible to decrypt and view captured network traffic.

The cybertrail is only useful for gathering information about an offender, not a victim.

What peer-to-peer clients use the Fast Track network?

Whois databases contain contact information relating to IP addresses but not domain names.

What are two of the most useful headers for determining the origination of Usenet messages?

Given the wealth of information that social networks contain, digital investigators will often find useful information at these sites.

Posting information online takes control of the information away from the person and such information can remain online indefinitely.

Which of the following applications leave traces of Internet activities on a personal computer?

When you access a web page, the content may be located on a server other than the one you accessed.

What information should you document when searching for evidence on the Web?

The "invisible Web" can only be accessed by government employees.

Criminals let their guard down in chat networks because they feel protected by the perceived anonymity.

Metaverseink is a:

When evidence is located on the Internet, investigators should document and preserve it immediately or it may be gone the next time they look for it.

Second Life is one of the better known:

The Web archive (web.archive.org) contains a complete and accurate copy of web pages as they existed at a particular time.

Which of the following enables a user to connect to IRC and run IRC fserves without disclosing their IP address?

Why is it important to hide your identity when conducting an online investigation?

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters