Question 1

What is considered to be the best way to preserve the layout of a crime scene?

Accepted Answer

A) Write down all information. 
B) Use a compact cassette recorder. 
C) Ask questions. 
D) Photograph it. 
A) Write down all information. 
B) Use a compact cassette recorder. 
C) Ask questions. 
D) Photograph it.

Question 2

Who has the legal authority to conduct a search in a criminal case?

Accepted Answer

A) It's decided by the local jurisdiction. 
B) It's decided by federal statutes. 
C) It's decided by the investigator on site. 
D) It's decided by the lead detective on the scene. 
A) It's decided by the local jurisdiction. 
B) It's decided by federal statutes. 
C) It's decided by the investigator on site. 
D) It's decided by the lead detective on the scene.

Question 3

Match the following basic tools to their components or uses in the field
-Bootable media

Accepted Answer

A) Useful for transferring large amounts of data or images 
B) Necessary if there are no convenient plugs 
C) Startup disks, CDs, or USB drives 
D) Used to keep notes or upload photographs 
E) Screwdrivers, pliers, duct tape 
A) Useful for transferring large amounts of data or images 
B) Necessary if there are no convenient plugs 
C) Startup disks, CDs, or USB drives 
D) Used to keep notes or upload photographs 
E) Screwdrivers, pliers, duct tape

Question 4

In order to protect a cellular phone for evidentiary procedures,transport it in a(n)___________.

Accepted Answer

The answer of In order to protect a cellular phone...

Question 5

The primary consideration in determining where to do the forensic work is always the

Accepted Answer

A) Estimation of personnel needed 
B) Integrity of the evidence 
C) Impact of the investigation on the organization 
D) Current number of cases being handled 
A) Estimation of personnel needed 
B) Integrity of the evidence 
C) Impact of the investigation on the organization 
D) Current number of cases being handled

Question 6

Place into correct order the steps when conducting an investigation.
-Second

Accepted Answer

A) Transport the evidence to the lab 
B) Tag the evidence 
C) Bag the evidence 
D) Document the evidence 
A) Transport the evidence to the lab 
B) Tag the evidence 
C) Bag the evidence 
D) Document the evidence

Question 7

If you find recent files of a particular application but the application itself is not present on the computer,what can you infer?

Accepted Answer

A) The computer user is not very experienced. 
B) The application file belongs on another computer. 
C) The application program has been recently installed. 
D) The application program is stored on some other storage device. 
A) The computer user is not very experienced. 
B) The application file belongs on another computer. 
C) The application program has been recently installed. 
D) The application program is stored on some other storage device.

Question 8

Match the following factors to their considerations.
-Estimation of time

Accepted Answer

A) How long will an on-site examination last? 
B) Will the investigation cause financial hardships? 
C) How volatile is the evidence? 
D) Is the equipment impractical? 
E) Is this to be done on-site or in the lab? 
A) How long will an on-site examination last? 
B) Will the investigation cause financial hardships? 
C) How volatile is the evidence? 
D) Is the equipment impractical? 
E) Is this to be done on-site or in the lab?

Question 9

A(n)________ needs to be completed when reviewing a potential case and determining whether to accept it.

Accepted Answer

general ca

Question 10

A(n)________ examination is where most of the computer forensic work is performed.

Accepted Answer

The answer of A(n)________ examination is where most of the...

Question 11

Match the following terms to their reporting definition.
-Body

Accepted Answer

A) Uses an algorithm to make readable 
B) Needs a word or phrase to unlock the file 
C) Data hides in another file 
D) Usually mail files 
A) Uses an algorithm to make readable 
B) Needs a word or phrase to unlock the file 
C) Data hides in another file 
D) Usually mail files

Question 12

The ________ of the extraction model is primarily concerned with developing a picture of how the system is set up.

Accepted Answer

The answer of The ________ of the extraction model is...

Question 13

Match the type of file with the definition:

-Steganography PPP

Accepted Answer

A) Uses an algorithm to make readable 
B) Needs a word or phrase to unlock the file 
C) Data hides in another file 
D) Usually mail files 
A) Uses an algorithm to make readable 
B) Needs a word or phrase to unlock the file 
C) Data hides in another file 
D) Usually mail files

Question 14

The main reason for file compression is to ________.

Accepted Answer

The answer of The main reason for file compression is...

Question 15

Include a(n)________ as part of your forensic equipment because it allows you to carry a library of forensic tools and can give you access to the Internet.

Accepted Answer

The answer of Include a(n)________ as part of your forensic...

Question 16

The system BIOS can tell you

Accepted Answer

A) Hard drive geometry settings 
B) What Web sites the user has visited recently 
C) The computer's operating system 
D) What applications are installed on the computer 
A) Hard drive geometry settings 
B) What Web sites the user has visited recently 
C) The computer's operating system 
D) What applications are installed on the computer

Question 17

Match the following basic tools to their components or uses in the field
-External USB drive

Accepted Answer

A) Useful for transferring large amounts of data or images 
B) Necessary if there are no convenient plugs 
C) Startup disks, CDs, or USB drives 
D) Used to keep notes or upload photographs 
E) Screwdrivers, pliers, duct tape 
A) Useful for transferring large amounts of data or images 
B) Necessary if there are no convenient plugs 
C) Startup disks, CDs, or USB drives 
D) Used to keep notes or upload photographs 
E) Screwdrivers, pliers, duct tape

Question 18

Match the following questions to their considerations.
-Do I need to preserve other evidence?

Accepted Answer

A) Identify the operating system or network topology 
B) There may be fingerprints or other trace evidence 
C) You would use different tools to locate different items such as photographs or spreadsheets 
D) This determines how you will extract the data 
E) The more skilled the user, the more likely it is that he can alter or destroy evidence 
A) Identify the operating system or network topology 
B) There may be fingerprints or other trace evidence 
C) You would use different tools to locate different items such as photographs or spreadsheets 
D) This determines how you will extract the data 
E) The more skilled the user, the more likely it is that he can alter or destroy evidence

Question 19

Match the following tools to their uses in the field.
-Forensic examiner platform

Accepted Answer

A)  Summarizes the case 
B)  Avoid contaminating evidence with your fingerprints 
C)  Write on CDs without damaging them 
D)  Use to record investigator actions 
E)  Use to acquire data in the field 
A)  Summarizes the case 
B)  Avoid contaminating evidence with your fingerprints 
C)  Write on CDs without damaging them 
D)  Use to record investigator actions 
E)  Use to acquire data in the field

Question 20

Match between columns
                        Premises: Hardware toolkit

Accepted Answer

The Answer of Necessary if there are no convenient plugs is...

What is considered to be the best way to preserve the layout of a crime scene?

Who has the legal authority to conduct a search in a criminal case?

Match the following basic tools to their components or uses in the field -Bootable media

In order to protect a cellular phone for evidentiary procedures,transport it in a(n)___________.

The primary consideration in determining where to do the forensic work is always the

Place into correct order the steps when conducting an investigation. -Second

If you find recent files of a particular application but the application itself is not present on the computer,what can you infer?

Match the following factors to their considerations. -Estimation of time

A(n)________ needs to be completed when reviewing a potential case and determining whether to accept it.

A(n)________ examination is where most of the computer forensic work is performed.

Match the following terms to their reporting definition. -Body

The ________ of the extraction model is primarily concerned with developing a picture of how the system is set up.

Match the type of file with the definition: -Steganography PPP

The main reason for file compression is to ________.

Include a(n)________ as part of your forensic equipment because it allows you to carry a library of forensic tools and can give you access to the Internet.

The system BIOS can tell you

Match the following basic tools to their components or uses in the field -External USB drive

Match the following questions to their considerations. -Do I need to preserve other evidence?

Match the following tools to their uses in the field. -Forensic examiner platform

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

Investigating Windows, linux, and Graphic Files

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters

Exam 4: Policies and Procedures

What is considered to be the best way to preserve the layout of a crime scene?

Who has the legal authority to conduct a search in a criminal case?

Match the following basic tools to their components or uses in the field -Bootable media

In order to protect a cellular phone for evidentiary procedures,transport it in a(n)___________.

The primary consideration in determining where to do the forensic work is always the

Place into correct order the steps when conducting an investigation. -Second

If you find recent files of a particular application but the application itself is not present on the computer,what can you infer?

Match the following factors to their considerations. -Estimation of time

A(n)________ needs to be completed when reviewing a potential case and determining whether to accept it.

A(n)________ examination is where most of the computer forensic work is performed.

Match the following terms to their reporting definition. -Body

The ________ of the extraction model is primarily concerned with developing a picture of how the system is set up.

Match the type of file with the definition: -Steganography PPP

The main reason for file compression is to ________.

Include a(n)________ as part of your forensic equipment because it allows you to carry a library of forensic tools and can give you access to the Internet.

The system BIOS can tell you

Match the following basic tools to their components or uses in the field -External USB drive

Match the following questions to their considerations. -Do I need to preserve other evidence?

Match the following tools to their uses in the field. -Forensic examiner platform

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

Investigating Windows, linux, and Graphic Files

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters