Question 1

Match each item with a statement below:
-a data-collecting tool

Accepted Answer

A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT 
A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT H

Question 2

Evidence is commonly lost or corrupted through ____, which involves police officers and other professionals who aren't part of the crime scene processing team.

Accepted Answer

A)  onlookers 
B)  HAZMAT teams 
C)  FOIA laws 
D)  professional curiosity 
A)  onlookers 
B)  HAZMAT teams 
C)  FOIA laws 
D)  professional curiosity D

Question 3

Generally, computer records are considered admissible if they qualify as a ____ record.

Accepted Answer

A)  hearsay 
B)  business 
C)  computer-generated 
D)  computer-stored 
A)  hearsay 
B)  business 
C)  computer-generated 
D)  computer-stored B

Question 4

Every business or organization must have a well defined process that describes when an investigation can be initiated. At a minimum, most corporate policies require that employers have a ____ that a law or policy is being violated.

Accepted Answer

A)  confirmed suspicion 
B)  proof 
C)  court order stating 
D)  reasonable suspicion 
A)  confirmed suspicion 
B)  proof 
C)  court order stating 
D)  reasonable suspicion

Question 5

Give some guidelines on how to video record a computer incident or crime scene.

Accepted Answer

Take video and still recordings of the a

Question 6

Courts consider evidence data in a computer as ____ evidence.

Accepted Answer

A)  physical 
B)  invalid 
C)  virtual 
D)  logical 
A)  physical 
B)  invalid 
C)  virtual 
D)  logical

Question 7

What is the plain view doctrine?

Accepted Answer

The plain view doctrine is defined in th

Question 8

Illustrate with an example the problems caused by commingled data.

Accepted Answer

Suppose that during an examination, you

Question 9

When recovering evidence from a contaminated crime scene, if the temperature in the contaminated room is higher than ____ degrees, you should take measures to prevent a hard disk from overheating to prevent damage.

Accepted Answer

A)  80 
B)  90 
C)  95 
D)  105 
A)  80 
B)  90 
C)  95 
D)  105

Question 10

How can you determine who is in charge of an investigation?

Accepted Answer

Corporate computing investigations usual

Question 11

_____________________ can be any information stored or transmitted in digital form.

Accepted Answer

The answer of _____________________ can be any information stored or...

Question 12

One technique for extracting evidence from large systems is called ____.

Accepted Answer

A)  RAID copy 
B)  RAID imaging 
C)  large evidence file recovery 
D)  sparse acquisition 
A)  RAID copy 
B)  RAID imaging 
C)  large evidence file recovery 
D)  sparse acquisition

Question 13

When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.

Accepted Answer

A)  Homeland Security Department 
B)  Patriot Act 
C)  U.S. DoJ 
D)  U.S. DoD 
A)  Homeland Security Department 
B)  Patriot Act 
C)  U.S. DoJ 
D)  U.S. DoD

Question 14

Match each item with a statement below:
-fingerprints can be tested with these systems

Accepted Answer

A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT 
A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT

Question 15

____ is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.

Accepted Answer

A)  Reasonable cause 
B)  Probable cause 
C)  A subpoena 
D)  A warrant 
A)  Reasonable cause 
B)  Probable cause 
C)  A subpoena 
D)  A warrant

Question 16

A judge can exclude evidence obtained from a poorly worded warrant.

Accepted Answer

A) True 
 B)False

Question 17

Match each item with a statement below:
-what most cases in the corporate environment are considered

Accepted Answer

A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT 
A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT

Question 18

Investigating and controlling computer incident scenes in the corporate environment is ____ in the criminal environment.

Accepted Answer

A)  much easier than 
B)  as easy as 
C)  as difficult as 
D)  more difficult than 
A)  much easier than 
B)  as easy as 
C)  as difficult as 
D)  more difficult than

Question 19

Match each item with a statement below:
-agencies must comply with these laws and make documents they find and create available as public records

Accepted Answer

A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT 
A) Innocent information 
B) AFIS 
C) EnCase Enterprise Edition 
D) FOIA 
E) IOCE
F)Low-level investigations
G)Hearsay
H)Spector
I)HAZMAT

Question 20

During an investigation involving a live computer, do not cut electrical power to the running system unless it's an older ____ or MS-DOS system.

Accepted Answer

A)  Windows XP 
B)  Windows 9x 
C)  Windows NT 
D)  Windows Me 
A)  Windows XP 
B)  Windows 9x 
C)  Windows NT 
D)  Windows Me

Match each item with a statement below: -a data-collecting tool

Evidence is commonly lost or corrupted through ____, which involves police officers and other professionals who aren't part of the crime scene processing team.

Generally, computer records are considered admissible if they qualify as a ____ record.

Every business or organization must have a well defined process that describes when an investigation can be initiated. At a minimum, most corporate policies require that employers have a ____ that a law or policy is being violated.

Give some guidelines on how to video record a computer incident or crime scene.

Courts consider evidence data in a computer as ____ evidence.

What is the plain view doctrine?

Illustrate with an example the problems caused by commingled data.

When recovering evidence from a contaminated crime scene, if the temperature in the contaminated room is higher than ____ degrees, you should take measures to prevent a hard disk from overheating to prevent damage.

How can you determine who is in charge of an investigation?

_____________________ can be any information stored or transmitted in digital form.

One technique for extracting evidence from large systems is called ____.

When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.

Match each item with a statement below: -fingerprints can be tested with these systems

____ is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.

A judge can exclude evidence obtained from a poorly worded warrant.

Match each item with a statement below: -what most cases in the corporate environment are considered

Investigating and controlling computer incident scenes in the corporate environment is ____ in the criminal environment.

Match each item with a statement below: -agencies must comply with these laws and make documents they find and create available as public records

During an investigation involving a live computer, do not cut electrical power to the running system unless it's an older ____ or MS-DOS system.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 5: Processing Crime and Incident Scenes

Match each item with a statement below: -a data-collecting tool

Evidence is commonly lost or corrupted through ____, which involves police officers and other professionals who aren't part of the crime scene processing team.

Generally, computer records are considered admissible if they qualify as a ____ record.

Every business or organization must have a well defined process that describes when an investigation can be initiated. At a minimum, most corporate policies require that employers have a ____ that a law or policy is being violated.

Give some guidelines on how to video record a computer incident or crime scene.

Courts consider evidence data in a computer as ____ evidence.

What is the plain view doctrine?

Illustrate with an example the problems caused by commingled data.

When recovering evidence from a contaminated crime scene, if the temperature in the contaminated room is higher than ____ degrees, you should take measures to prevent a hard disk from overheating to prevent damage.

How can you determine who is in charge of an investigation?

_____________________ can be any information stored or transmitted in digital form.

One technique for extracting evidence from large systems is called ____.

When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.

Match each item with a statement below: -fingerprints can be tested with these systems

____ is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.

A judge can exclude evidence obtained from a poorly worded warrant.

Match each item with a statement below: -what most cases in the corporate environment are considered

Investigating and controlling computer incident scenes in the corporate environment is ____ in the criminal environment.

Match each item with a statement below: -agencies must comply with these laws and make documents they find and create available as public records

During an investigation involving a live computer, do not cut electrical power to the running system unless it's an older ____ or MS-DOS system.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters