Question 1

Match each item with a statement below:
-letters embedded near the beginning of all JPEG files

Accepted Answer

A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack 
A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack

Question 2

Many password recovery tools have a feature that allows generating potential lists for a ____ attack.

Accepted Answer

A)  brute-force 
B)  password dictionary 
C)  birthday 
D)  salting 
A)  brute-force 
B)  password dictionary 
C)  birthday 
D)  salting

Question 3

Although a disk editor gives you the most flexibility in ____, it might not be capable of examining a ____ file's contents.

Accepted Answer

A)  testing, compressed 
B)  scanning, text 
C)  testing, pdf 
D)  testing, doc 
A)  testing, compressed 
B)  scanning, text 
C)  testing, pdf 
D)  testing, doc

Question 4

Software forensics tools are commonly used to copy data from a suspect's disk drive to a(n) ____.

Accepted Answer

A)  backup file 
B)  firmware 
C)  image file 
D)  recovery copy 
A)  backup file 
B)  firmware 
C)  image file 
D)  recovery copy

Question 5

Match each item with a statement below:
-command-line disk acquisition tool from New Technologies, Inc.

Accepted Answer

A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack 
A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack

Question 6

In general, forensics workstations can be divided into ____ categories.

Accepted Answer

A)  2 
B)  3 
C)  4 
D)  5 
A)  2 
B)  3 
C)  4 
D)  5

Question 7

The standards document, ____, demands accuracy for all aspects of the testing process, meaning that the results must be repeatable and reproducible.

Accepted Answer

A)  ISO 3657 
B)  ISO 5321 
C)  ISO 5725 
D)  ISO 17025 
A)  ISO 3657 
B)  ISO 5321 
C)  ISO 5725 
D)  ISO 17025

Question 8

One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex.

Accepted Answer

A)  disk imager 
B)  write-blocker 
C)  bit-stream copier 
D)  disk editor 
A)  disk imager 
B)  write-blocker 
C)  bit-stream copier 
D)  disk editor

Question 9

Match each item with a statement below:
-European term for carving

Accepted Answer

A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack 
A) JFIF 
B) Lightweight workstation 
C) Pagefile.sys 
D) Salvaging 
E) Raw data
F)PDBlock
G)Norton DiskEdit
H)Stationary workstation
I)SafeBack

Question 10

____ of data involves sorting and searching through all investigation data.

Accepted Answer

A)  Validation 
B)  Discrimination 
C)  Acquisition 
D)  Reconstruction 
A)  Validation 
B)  Discrimination 
C)  Acquisition 
D)  Reconstruction

Match each item with a statement below: -letters embedded near the beginning of all JPEG files

Many password recovery tools have a feature that allows generating potential lists for a ____ attack.

Although a disk editor gives you the most flexibility in , it might not be capable of examining a file's contents.

Software forensics tools are commonly used to copy data from a suspect's disk drive to a(n) ____.

Match each item with a statement below: -command-line disk acquisition tool from New Technologies, Inc.

In general, forensics workstations can be divided into ____ categories.

The standards document, ____, demands accuracy for all aspects of the testing process, meaning that the results must be repeatable and reproducible.

One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex.

Match each item with a statement below: -European term for carving

____ of data involves sorting and searching through all investigation data.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 7: Current Computer Forensics Tools

Match each item with a statement below: -letters embedded near the beginning of all JPEG files

Many password recovery tools have a feature that allows generating potential lists for a ____ attack.

Although a disk editor gives you the most flexibility in ____, it might not be capable of examining a ____ file's contents.

Software forensics tools are commonly used to copy data from a suspect's disk drive to a(n) ____.

Match each item with a statement below: -command-line disk acquisition tool from New Technologies, Inc.

In general, forensics workstations can be divided into ____ categories.

The standards document, ____, demands accuracy for all aspects of the testing process, meaning that the results must be repeatable and reproducible.

One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex.

Match each item with a statement below: -European term for carving

____ of data involves sorting and searching through all investigation data.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Although a disk editor gives you the most flexibility in , it might not be capable of examining a file's contents.