Question 1

The definition of software is:

Accepted Answer

A)  primary component of storage in the personal computer 
B)  program permitting the user to manage files and applications 
C)  set of instructions compiled into a program that performs a particular task 
D)  storage programs used to start the boot process 
E)  a complex network of wires that carry data from one hardware device to another 
A)  primary component of storage in the personal computer 
B)  program permitting the user to manage files and applications 
C)  set of instructions compiled into a program that performs a particular task 
D)  storage programs used to start the boot process 
E)  a complex network of wires that carry data from one hardware device to another C

Question 2

Describe the difference between read-only memory and random-access memory.

Accepted Answer

Read-only Memory (ROM) and Random-Access Memory (RAM) are two fundamental types of memory used in computers and electronic devices, each serving distinct purposes and having different characteristics.

Read-only Memory (ROM):
1. Non-volatile: ROM retains its data even when the power is turned off. This makes it ideal for storing firmware or permanent software that should not be altered or lost when the device is powered down.
2. Pre-programmed: Data in ROM is typically written during the manufacturing process and is not intended to be modified by the end-user. Some types of ROM, like EEPROM, can be rewritten, but this is a slow process and not done frequently.
3. Read-only: As the name suggests, ROM is primarily designed to be read from, not written to. It is used to store the instructions for booting up the computer or device (the bootloader or BIOS).
4. Speed: ROM is generally slower than RAM in terms of data access speeds.

Random-Access Memory (RAM):
1. Volatile: RAM requires power to maintain its data. When the device is turned off, the data stored in RAM is lost. This is why you lose unsaved work if your computer crashes or is turned off unexpectedly.
2. Read and Write: RAM is used by the CPU to read and write data quickly. It is where a computer temporarily stores data that is actively being used or processed, which allows for fast access and manipulation.
3. Dynamic: The contents of RAM change frequently as programs are opened and closed and as different tasks are performed. It is the workspace for the computer's processor.
4. Speed: RAM is much faster than ROM. This speed allows the CPU to access instructions and data quickly, which is essential for the smooth operation of programs.

In summary, ROM is non-volatile and used for permanent storage of critical instructions that do not change, while RAM is volatile and used for temporary storage of data that is actively being used or processed by the CPU. ROM is about long-term stability and preservation, whereas RAM is about speed and flexibility for on-the-fly data manipulation.

Question 3

Evidentiary data may be recovered from which of the following?

Accepted Answer

A)  RAM swap files 
B)  unallocated space on the HDD 
C)  slack space on the HDD 
D)  all of the above 
E)  none of the above 
A)  RAM swap files 
B)  unallocated space on the HDD 
C)  slack space on the HDD 
D)  all of the above 
E)  none of the above D

Question 4

A cluster is a group of ________ in multiples of ________.

Accepted Answer

A)  cylinders, three 
B)  tracks, three 
C)  sectors, two 
D)  partitions, two 
E)  disks, four 
A)  cylinders, three 
B)  tracks, three 
C)  sectors, two 
D)  partitions, two 
E)  disks, four

Question 5

Which of the following actions taken at the crime scene involving a computer are incorrect?

Accepted Answer

A)  upon arrival, sketching the overall layout as well as photographing it 
B)  photographing any running monitors 
C)  placing corresponding labels on cords from peripheral devices and the port to which each cord was connected 
D)  removing the plug from the back of the computer, not from the wall 
E)  none of the above 
A)  upon arrival, sketching the overall layout as well as photographing it 
B)  photographing any running monitors 
C)  placing corresponding labels on cords from peripheral devices and the port to which each cord was connected 
D)  removing the plug from the back of the computer, not from the wall 
E)  none of the above

Question 6

One should not search for "visible" data in:

Accepted Answer

A)  unallocated space. 
B)  swab files. 
C)  windows. 
D)  Quicken. 
E)  temporary files. 
A)  unallocated space. 
B)  swab files. 
C)  windows. 
D)  Quicken. 
E)  temporary files.

Question 7

A device that permits only requested traffic to enter a computer system is known as a(n) :

Accepted Answer

A)  internet cache 
B)  network traffic manager 
C)  firewall 
D)  central processing unit (CPU) 
E)  cookie 
A)  internet cache 
B)  network traffic manager 
C)  firewall 
D)  central processing unit (CPU) 
E)  cookie

Question 8

One should not look for "latent" data in:

Accepted Answer

A)  RAM slack. 
B)  temporary files. 
C)  unallocated space. 
D)  file slack. 
E)  deleted files. 
A)  RAM slack. 
B)  temporary files. 
C)  unallocated space. 
D)  file slack. 
E)  deleted files.

Question 9

One of the most common places to begin to look for evidential data is in:

Accepted Answer

A)  any learn-to-type tutorial. 
B)  the spreadsheet files. 
C)  the word processing or text-based document files. 
D)  a CAD package. 
E)  a photograph editing program. 
A)  any learn-to-type tutorial. 
B)  the spreadsheet files. 
C)  the word processing or text-based document files. 
D)  a CAD package. 
E)  a photograph editing program.

Question 10

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

Accepted Answer

A)  tape each cable to its adjoining component in an effort to preserve the integrity of the physical connections. 
B)  procure a warrant to search. 
C)  document the scene. 
D)  remove the system to the laboratory for processing. 
E)  unplug every device from the CPU to preserve the hard disk drive. 
A)  tape each cable to its adjoining component in an effort to preserve the integrity of the physical connections. 
B)  procure a warrant to search. 
C)  document the scene. 
D)  remove the system to the laboratory for processing. 
E)  unplug every device from the CPU to preserve the hard disk drive.

Question 11

What are the areas of the computer that forensic examiners will examine to retrieve forensic data.

Accepted Answer

Computer forensic examiners investigate

Question 12

What keeps track of the location of files and folders on the HDD?

Accepted Answer

A)  the HDD itself 
B)  the CD-ROM 
C)  the FAT 
D)  the CPU 
E)  the search engine 
A)  the HDD itself 
B)  the CD-ROM 
C)  the FAT 
D)  the CPU 
E)  the search engine

Question 13

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

Accepted Answer

A)  the BIOS. 
B)  system bus. 
C)  RAM. 
D)  ROM. 
E)  central processing unit. 
A)  the BIOS. 
B)  system bus. 
C)  RAM. 
D)  ROM. 
E)  central processing unit.

Question 14

A motherboard:

Accepted Answer

A)  has a socket to accept RAM. 
B)  connects to every device used by the system. 
C)  is the main circuit board within a computer. 
D)  all of the above 
E)  none of the above 
A)  has a socket to accept RAM. 
B)  connects to every device used by the system. 
C)  is the main circuit board within a computer. 
D)  all of the above 
E)  none of the above

Question 15

Explain the various areas found on the computer where a user's Internet activities can be investigated.

Accepted Answer

There are several areas on a computer wh

Question 16

Which of the following is NOT considered a type of software?

Accepted Answer

A)  Linux 
B)  Unix 
C)  Firefox 
D)  Random Access Memory 
E)  Excel 
A)  Linux 
B)  Unix 
C)  Firefox 
D)  Random Access Memory 
E)  Excel

Question 17

What is the difference between and location of visible and latent data?

Accepted Answer

Visible data and latent data refer to tw

Question 18

List and describe the hardware and the software components of a computer.

Accepted Answer

Sure! The hardware components of a compu

Question 19

Describe how a hard disk is partitioned.

Accepted Answer

A hard disk is partitioned by dividing i

Question 20

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

Accepted Answer

A)  Internet "cookies" 
B)  Internet history 
C)  cache 
D)  all of the above 
E)  A and B only 
A)  Internet "cookies" 
B)  Internet history 
C)  cache 
D)  all of the above 
E)  A and B only

The definition of software is:

Describe the difference between read-only memory and random-access memory.

Evidentiary data may be recovered from which of the following?

A cluster is a group of in multiples of .

Which of the following actions taken at the crime scene involving a computer are incorrect?

One should not search for "visible" data in:

A device that permits only requested traffic to enter a computer system is known as a(n) :

One should not look for "latent" data in:

One of the most common places to begin to look for evidential data is in:

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

What are the areas of the computer that forensic examiners will examine to retrieve forensic data.

What keeps track of the location of files and folders on the HDD?

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

A motherboard:

Explain the various areas found on the computer where a user's Internet activities can be investigated.

Which of the following is NOT considered a type of software?

What is the difference between and location of visible and latent data?

List and describe the hardware and the software components of a computer.

Describe how a hard disk is partitioned.

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

Introduction

Securing and Searching the Crime Scene

Recording the Crime Scene

Collection of Crime-Scene Evidence

Physical Evidence

Death Investigation

Crime-Scene Reconstruction

Fingerprints

Firearms, Toolmarks, and Other Impressions

Bloodstain Pattern Analysis

Drugs

Forensic Toxicology

Trace Evidence I: Hairs and Fibers

Trace Evidence Ii: Paint, Glass, and Soil

Biological Stain Analysis: DNA

Forensic Aspects of Fire and Explosion Investigation

Document Examination

Filters

Exam 18: Computer Forensics

The definition of software is:

Describe the difference between read-only memory and random-access memory.

Evidentiary data may be recovered from which of the following?

A cluster is a group of ________ in multiples of ________.

Which of the following actions taken at the crime scene involving a computer are incorrect?

One should not search for "visible" data in:

A device that permits only requested traffic to enter a computer system is known as a(n) :

One should not look for "latent" data in:

One of the most common places to begin to look for evidential data is in:

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

What are the areas of the computer that forensic examiners will examine to retrieve forensic data.

What keeps track of the location of files and folders on the HDD?

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

A motherboard:

Explain the various areas found on the computer where a user's Internet activities can be investigated.

Which of the following is NOT considered a type of software?

What is the difference between and location of visible and latent data?

List and describe the hardware and the software components of a computer.

Describe how a hard disk is partitioned.

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

Introduction

Securing and Searching the Crime Scene

Recording the Crime Scene

Collection of Crime-Scene Evidence

Physical Evidence

Death Investigation

Crime-Scene Reconstruction

Fingerprints

Firearms, Toolmarks, and Other Impressions

Bloodstain Pattern Analysis

Drugs

Forensic Toxicology

Trace Evidence I: Hairs and Fibers

Trace Evidence Ii: Paint, Glass, and Soil

Biological Stain Analysis: DNA

Forensic Aspects of Fire and Explosion Investigation

Document Examination

Filters

A cluster is a group of in multiples of .