Question 1

After you close the case and make your final report, you need to meet with your department or a group of fellow investigators and ____.

Accepted Answer

A)  critique the case 
B)  repeat the case 
C)  present the case 
D)  read the final report 
A)  critique the case 
B)  repeat the case 
C)  present the case 
D)  read the final report

Question 2

To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as a ____.

Accepted Answer

A)  mobile workstation 
B)  forensic workstation 
C)  forensic lab 
D)  recovery workstation 
A)  mobile workstation 
B)  forensic workstation 
C)  forensic lab 
D)  recovery workstation

Question 3

You can use ____ to boot to Windows without writing any data to the evidence disk.

Accepted Answer

A)  a SCSI boot up disk 
B)  a Windows boot up disk 
C)  a write-blocker 
D)  Windows XP 
A)  a SCSI boot up disk 
B)  a Windows boot up disk 
C)  a write-blocker 
D)  Windows XP

Question 4

A(n) ____________________ lists each piece of evidence on a separate page.

Accepted Answer

single-evi

Question 5

Chain of custody is also known as chain of evidence.

Accepted Answer

A) True 
 B)False

Question 6

Match each item with a statement below:
-can be used for new files that are saved or files that expand as data is added to them

Accepted Answer

A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation 
A) FTK's Internet Keyword Search 
B) Data recovery 
C) Free space 
D) Interrogation 
E) Forensic workstation
F)Norton DiskEdit
G)MS-DOS 6.22
H)Multi-evidence form
I)Self-evaluation

Question 7

What should you do to handle evidence contained in large computer components?

Accepted Answer

To secure and catalog the evidence conta

Question 8

Employees surfing the Internet can cost companies millions of dollars.

Accepted Answer

A) True 
 B)False

Question 9

You cannot use both multi-evidence and single-evidence forms in your investigation.

Accepted Answer

A) True 
 B)False

Question 10

What items are needed when gathering the resources you identified in your investigation plan?

Accepted Answer

You need the following items:
* Original

After you close the case and make your final report, you need to meet with your department or a group of fellow investigators and ____.

To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as a ____.

You can use ____ to boot to Windows without writing any data to the evidence disk.

A(n) ____________________ lists each piece of evidence on a separate page.

Chain of custody is also known as chain of evidence.

Match each item with a statement below: -can be used for new files that are saved or files that expand as data is added to them

What should you do to handle evidence contained in large computer components?

Employees surfing the Internet can cost companies millions of dollars.

You cannot use both multi-evidence and single-evidence forms in your investigation.

What items are needed when gathering the resources you identified in your investigation plan?

Computer Forensics and Investigations As a Profession

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 2: Understanding Computer Investigations

After you close the case and make your final report, you need to meet with your department or a group of fellow investigators and ____.

To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as a ____.

You can use ____ to boot to Windows without writing any data to the evidence disk.

A(n) ____________________ lists each piece of evidence on a separate page.

Chain of custody is also known as chain of evidence.

Match each item with a statement below: -can be used for new files that are saved or files that expand as data is added to them

What should you do to handle evidence contained in large computer components?

Employees surfing the Internet can cost companies millions of dollars.

You cannot use both multi-evidence and single-evidence forms in your investigation.

What items are needed when gathering the resources you identified in your investigation plan?

Computer Forensics and Investigations As a Profession

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters