Exam 19: Computer Forensics

Software comprises the physical components of the computer.

One gigabyte can be expressed as:

An investigator would like to take a forensic "image" of a suspect's HDD. What is the primary goal in obtaining data from a HDD? What tools can the investigator use to achieve this goal?

List four mobile services that are offered on today's mobile devices and explain their potential evidentiary value.

Which of the following actions taken at the crime scene involving a computer is incorrect?

Chat and instant messages typically are stored in ________.

Investigators would want to copy blank or unused portions of the HDD to preserve ________ data.

When is it necessary to make a "fingerprint" of a HDD?

Hard drive partitions are typically divided into:

An IP address may lead to the identity of the person who was using a particular computer to access the Internet.

An IP address typically takes the form ###.###.###.###, in which ### can be any number from 0 to 255.

Most web browsers use a(n)________ to expedite and streamline browsing.

The operating systems of mobile devices are usually the same.

ROM stores software programs and instructions while the computer is turned on.

Which of the following carries data from one hardware device to another?

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Cluster

Extraction of data from a mobile device can be done on a physical level and a(n)________ level.

________ is a set of instructions compiled into a program that performs a particular task.

What type of memory stores software programs and instructions while the computer is turned on? What special considerations must be taken to preserve this type of memory on a computer at a crime scene?