Question 1

The ____________________ function is the most demanding of all tasks for computer investigators to master.

Accepted Answer

The answer of The ____________________ function is the most demanding...

Question 2

The ____ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software.

Accepted Answer

A)  CFTT 
B)  NIST 
C)  FS-TST 
D)  NSRL 
A)  CFTT 
B)  NIST 
C)  FS-TST 
D)  NSRL

Question 3

Briefly explain the NIST general approach for testing computer forensics tools.

Accepted Answer

NIST has created criteria for testing co

Question 4

The primary hash algorithm used by the NSRL project is ____.

Accepted Answer

A)  MD5 
B)  SHA-1 
C)  CRC-32 
D)  RC4 
A)  MD5 
B)  SHA-1 
C)  CRC-32 
D)  RC4

Question 5

____ can be software or hardware and are used to protect evidence disks by preventing you from writing any data to the evidence disk.

Accepted Answer

A)  Drive-imaging 
B)  Disk editors 
C)  Workstations 
D)  Write-blockers 
A)  Drive-imaging 
B)  Disk editors 
C)  Workstations 
D)  Write-blockers

Question 6

Briefly explain the purpose of the NIST NSRL project.

Accepted Answer

The purpose of the NSRL project is to re

Question 7

To complete a forensic disk analysis and examination, you need to create a ____.

Accepted Answer

A)  forensic disk copy 
B)  risk assessment 
C)  budget plan 
D)  report 
A)  forensic disk copy 
B)  risk assessment 
C)  budget plan 
D)  report

Question 8

In software acquisition, there are three types of data-copying methods.

Accepted Answer

A) True 
 B)False

Question 9

Match each item with a statement below:
-software-enabled write-blocker

Accepted Answer

A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack 
A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack

Question 10

In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network.

Accepted Answer

A)  Dir 
B)  ls 
C)  Copy 
D)  owner 
A)  Dir 
B)  ls 
C)  Copy 
D)  owner

Question 11

Because there are a number of different versions of UNIX and Linux, these platforms are referred to as ____________________ platforms.

Accepted Answer

The answer of Because there are a number of different...

Question 12

Computer forensics tools are divided into ____ major categories.

Accepted Answer

A)  2 
B)  3 
C)  4 
D)  5 
A)  2 
B)  3 
C)  4 
D)  5

Question 13

Explain the validation of evidence data process.

Accepted Answer

Validating data is done by obtaining has

Question 14

Match each item with a statement below:
-a direct copy of a disk drive

Accepted Answer

A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack 
A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack

Question 15

The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems.

Accepted Answer

A)  Apple 
B)  Atari 
C)  Commodore 
D)  IBM 
A)  Apple 
B)  Atari 
C)  Commodore 
D)  IBM

Question 16

The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.

Accepted Answer

A)  partition-to-partition 
B)  image-to-partition 
C)  disk-to-disk 
D)  image-to-disk 
A)  partition-to-partition 
B)  image-to-partition 
C)  disk-to-disk 
D)  image-to-disk

Question 17

The Windows application of EnCase requires a(n) ____________________ device, such as FastBloc, to prevent Windows from accessing and corrupting a suspect disk drive.

Accepted Answer

The answer of The Windows application of EnCase requires a(n)...

Question 18

Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.

Accepted Answer

A)  rawcp 
B)  dd 
C)  d2dump 
D)  dhex 
A)  rawcp 
B)  dd 
C)  d2dump 
D)  dhex

Question 19

Illustrate how to consider hardware needs when planning your lab budget.

Accepted Answer

You should plan your hardware needs care

Question 20

Describe some of the problems you may encounter if you decide to build your own forensics workstation.

Accepted Answer

To decide whether you want to build your

The ____________________ function is the most demanding of all tasks for computer investigators to master.

The ____ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software.

Briefly explain the NIST general approach for testing computer forensics tools.

The primary hash algorithm used by the NSRL project is ____.

____ can be software or hardware and are used to protect evidence disks by preventing you from writing any data to the evidence disk.

Briefly explain the purpose of the NIST NSRL project.

To complete a forensic disk analysis and examination, you need to create a ____.

In software acquisition, there are three types of data-copying methods.

Match each item with a statement below: -software-enabled write-blocker

In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network.

Because there are a number of different versions of UNIX and Linux, these platforms are referred to as ____________________ platforms.

Computer forensics tools are divided into ____ major categories.

Explain the validation of evidence data process.

Match each item with a statement below: -a direct copy of a disk drive

The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems.

The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.

The Windows application of EnCase requires a(n) ____________________ device, such as FastBloc, to prevent Windows from accessing and corrupting a suspect disk drive.

Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.

Illustrate how to consider hardware needs when planning your lab budget.

Describe some of the problems you may encounter if you decide to build your own forensics workstation.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 7: Current Computer Forensics Tools

The ____________________ function is the most demanding of all tasks for computer investigators to master.

The ____ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software.

Briefly explain the NIST general approach for testing computer forensics tools.

The primary hash algorithm used by the NSRL project is ____.

____ can be software or hardware and are used to protect evidence disks by preventing you from writing any data to the evidence disk.

Briefly explain the purpose of the NIST NSRL project.

To complete a forensic disk analysis and examination, you need to create a ____.

In software acquisition, there are three types of data-copying methods.

Match each item with a statement below: -software-enabled write-blocker

In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network.

Because there are a number of different versions of UNIX and Linux, these platforms are referred to as ____________________ platforms.

Computer forensics tools are divided into ____ major categories.

Explain the validation of evidence data process.

Match each item with a statement below: -a direct copy of a disk drive

The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems.

The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.

The Windows application of EnCase requires a(n) ____________________ device, such as FastBloc, to prevent Windows from accessing and corrupting a suspect disk drive.

Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.

Illustrate how to consider hardware needs when planning your lab budget.

Describe some of the problems you may encounter if you decide to build your own forensics workstation.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters