Exam 23: Computer Forensics

There are four different types of evidence: direct,real,documentary,and _______________.

A(n)_______________ is the result of applying the hash function to data.

The term forensics relates to the application of ____________ knowledge to ___________ problems.

The cluster that holds the fragment of the original file is referred to as _______________,because the operating system has marked it as usable when needed.

What are the considerations when preserving evidence?

The space that is left over in a cluster is called slack space.

What are three environmental factors that evidence needs to be protected from?

Which of the following has the least volatile data?

_______________ performs a function similar to the familiar parity bits,checksum,or cyclical redundancy check (CRC).

_______________ evidence refers to evidence in the form of business records,printouts,manuals and the like.

What is a message digest?

What is a software bomb?

What type of evidence is used to aid a jury and may be in the form of a model,experiment,chart,and so on,to indicate that an event occurred?

To be credible in court proceedings,what are the three standards that evidence must meet?

Generally speaking,you should back up the computer using DOS instead of Windows.

Business records,printouts,and manuals are what type of evidence?

The recycle bin contains all the deleted files on a computer.

Evidence that is material to the case or has bearing on the matter at hand is what standard of evidence?

Evidence must meet the three standards of being sufficient,competent,and _______________.

When performing forensics on a computer system you should use the utilities provided by that system.