Question 1

When analyzing digital evidence, your job is to ____.

Accepted Answer

A)  recover the data 
B)  destroy the data 
C)  copy the data 
D)  load the data 
A)  recover the data 
B)  destroy the data 
C)  copy the data 
D)  load the data A

Question 2

Many attorneys like to have printouts of the data you have recovered, but printouts can present problems when you have log files with several thousand pages of data.

Accepted Answer

A) True 
 B)False  True

Question 3

During the ____________________ design or approach to the case, you outline the general steps you need to follow to investigate the case.

Accepted Answer

preliminary

Question 4

process of trying to get a suspect to confess to a specific incident or crime

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 5

What additional items are useful when setting up a forensic workstation?

Accepted Answer

Additional useful items include the foll

Question 6

an essential part of professional growth

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 7

A(n) ____________________ is usually conducted to collect information from a witness or suspect about specific facts related to an investigation.

Accepted Answer

The answer of A(n) ____________________ is usually conducted to collect...

Question 8

What is required to conduct an investigation involving Internet abuse?

Accepted Answer

To conduct an investigation involving In

Question 9

____ can be the most time-consuming task, even when you know exactly what to look for in the evidence.

Accepted Answer

A)  Evidence recovery 
B)  Data recovery 
C)  Data analysis 
D)  Evidence recording 
A)  Evidence recovery 
B)  Data recovery 
C)  Data analysis 
D)  Evidence recording

Question 10

To create an exact image of an evidence disk, copying the ____ to a target work disk that's identical to the evidence disk is preferable.

Accepted Answer

A)  removable copy 
B)  backup copy 
C)  bit-stream image 
D)  backup image 
A)  removable copy 
B)  backup copy 
C)  bit-stream image 
D)  backup image

Question 11

a type of evidence custody form

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 12

Match each item with a statement below:
-is the more well-known and lucrative side of the computer forensics business

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 13

Match each item with a statement below:
-an older computer forensics tool

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 14

also known as a computer forensics workstation

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 15

____ from Technology Pathways is a forensics data analysis tool. You can use it to acquire and analyze data from several different file systems.

Accepted Answer

A)  Guidance EnCase 
B)  NTI SafeBack 
C)  DataArrest SnapCopy 
D)  ProDiscover Basic 
A)  Guidance EnCase 
B)  NTI SafeBack 
C)  DataArrest SnapCopy 
D)  ProDiscover Basic

Question 16

____ investigations typically include spam, inappropriate and offensive message content, and harassment or threats.

Accepted Answer

A)  VPN 
B)  Internet 
C)  E-mail 
D)  Phone 
A)  VPN 
B)  Internet 
C)  E-mail 
D)  Phone

Question 17

Use ____ to secure and catalog the evidence contained in large computer components.

Accepted Answer

A)  Hefty bags 
B)  regular bags 
C)  paper bags 
D)  evidence bags 
A)  Hefty bags 
B)  regular bags 
C)  paper bags 
D)  evidence bags

Question 18

A bit-stream image is also known as a(n) ____.

Accepted Answer

A)  backup copy 
B)  forensic copy 
C)  custody copy 
D)  evidence copy 
A)  backup copy 
B)  forensic copy 
C)  custody copy 
D)  evidence copy

Question 19

Describe the process of creating a bit-stream copy of an evidence disk.

Accepted Answer

To create an exact image of an evidence

Question 20

Describe some of the technologies used with hardware write-blocker devices. Identify some of the more commonly used vendors and their products.

Accepted Answer

There are many hardware write-blockers o

When analyzing digital evidence, your job is to ____.

Many attorneys like to have printouts of the data you have recovered, but printouts can present problems when you have log files with several thousand pages of data.

During the ____________________ design or approach to the case, you outline the general steps you need to follow to investigate the case.

process of trying to get a suspect to confess to a specific incident or crime

What additional items are useful when setting up a forensic workstation?

an essential part of professional growth

A(n) ____________________ is usually conducted to collect information from a witness or suspect about specific facts related to an investigation.

What is required to conduct an investigation involving Internet abuse?

____ can be the most time-consuming task, even when you know exactly what to look for in the evidence.

To create an exact image of an evidence disk, copying the ____ to a target work disk that's identical to the evidence disk is preferable.

a type of evidence custody form

Match each item with a statement below: -is the more well-known and lucrative side of the computer forensics business

Match each item with a statement below: -an older computer forensics tool

also known as a computer forensics workstation

____ from Technology Pathways is a forensics data analysis tool. You can use it to acquire and analyze data from several different file systems.

____ investigations typically include spam, inappropriate and offensive message content, and harassment or threats.

Use ____ to secure and catalog the evidence contained in large computer components.

A bit-stream image is also known as a(n) ____.

Describe the process of creating a bit-stream copy of an evidence disk.

Describe some of the technologies used with hardware write-blocker devices. Identify some of the more commonly used vendors and their products.

Computer Forensics and Investigations As a Profession

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 2: Understanding Computer Investigations

When analyzing digital evidence, your job is to ____.

Many attorneys like to have printouts of the data you have recovered, but printouts can present problems when you have log files with several thousand pages of data.

During the ____________________ design or approach to the case, you outline the general steps you need to follow to investigate the case.

process of trying to get a suspect to confess to a specific incident or crime

What additional items are useful when setting up a forensic workstation?

an essential part of professional growth

A(n) ____________________ is usually conducted to collect information from a witness or suspect about specific facts related to an investigation.

What is required to conduct an investigation involving Internet abuse?

____ can be the most time-consuming task, even when you know exactly what to look for in the evidence.

To create an exact image of an evidence disk, copying the ____ to a target work disk that's identical to the evidence disk is preferable.

a type of evidence custody form

Match each item with a statement below: -is the more well-known and lucrative side of the computer forensics business

Match each item with a statement below: -an older computer forensics tool

also known as a computer forensics workstation

____ from Technology Pathways is a forensics data analysis tool. You can use it to acquire and analyze data from several different file systems.

____ investigations typically include spam, inappropriate and offensive message content, and harassment or threats.

Use ____ to secure and catalog the evidence contained in large computer components.

A bit-stream image is also known as a(n) ____.

Describe the process of creating a bit-stream copy of an evidence disk.

Describe some of the technologies used with hardware write-blocker devices. Identify some of the more commonly used vendors and their products.

Computer Forensics and Investigations As a Profession

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters