Exam 19: Computer Forensics

Which of the following is NOT considered a type of software?

What keeps track of the location of files and folders on the HDD?

One of the most common places to begin to look for evidential data is in:

The primary storage device on most computers is the hard disk drive (HDD).

A domain manages traffic between computers on a network.

What does IP stand for in IP address? What function can an IP address serve in a forensic investigation?

In which of the following places would a computer forensic investigator look for latent data?

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Firewall

Extracting data from a mobile device is more complicated than extracting data from a computer.

A(n)________ is a device that permits only requested traffic to enter a computer system.

The primary goal in obtaining data from a HDD is to do so without altering even one bit of data.

Clusters are groups of ________.

The central processing unit, or CPU, is the part of the computer that actually computes.

Which source will NOT be useful to investigators seeking to determine a user's Internet history?

Name two situations in which an investigator would not immediately unplug a computer at an electronic crime scene.

Sectors are typically how many bytes in size?

Which of the following is NOT associated with the partitioning of a HDD?

Once a file is deleted by a user, it:

The travel history of a suspect can be documented using ________ and map data from a mobile device.

Often mobile devices contain the same Internet artifacts as a computer, such as cookies and browser history.