Question 1

Describe how e-mails, chat and IM's can be traced and recovered by a computer forensics expert.

Accepted Answer

E-mails, chat messages, and instant mess

Question 2

One gigabyte can be expressed as:

Accepted Answer

A)  1,000 kilobytes (K
B) . 
B)  1,000 bytes. 
C)  1,000 megabytes (M
B) . 
D)  8,000 bits. 
E)  80,000 kilobytes (K
B) . 
A)  1,000 kilobytes (K
B) . 
B)  1,000 bytes. 
C)  1,000 megabytes (M
B) . 
D)  8,000 bits. 
E)  80,000 kilobytes (K
B) .

Question 3

Unauthorized intrusion into a computer is called:

Accepted Answer

A)  whacking. 
B)  spamming. 
C)  crashing. 
D)  hacking. 
E)  slamming. 
A)  whacking. 
B)  spamming. 
C)  crashing. 
D)  hacking. 
E)  slamming.

Question 4

Which of the following is not considered to be classified as software?

Accepted Answer

A)  Floppy discs 
B)  Accounting applications 
C)  Web browsers 
D)  Operating systems 
E)  Word processors 
A)  Floppy discs 
B)  Accounting applications 
C)  Web browsers 
D)  Operating systems 
E)  Word processors

Question 5

The primary form of data storage within a personal computer is:

Accepted Answer

A)  the CD-ROM. 
B)  a zip drive. 
C)  the hard disk drive. 
D)  a thumb drive. 
E)  the recycle bin. 
A)  the CD-ROM. 
B)  a zip drive. 
C)  the hard disk drive. 
D)  a thumb drive. 
E)  the recycle bin.

Question 6

Hard drive partitions are typically divided into:

Accepted Answer

A)  Clusters 
B)  Sectors 
C)  Cylinders 
D)  Tracks 
E)  All of the above 
A)  Clusters 
B)  Sectors 
C)  Cylinders 
D)  Tracks 
E)  All of the above

Question 7

The ultimate goal of obtaining an image of a hard disk drive is to:

Accepted Answer

A)  do so without altering the drive in any way. 
B)  attempt to determine the owner of the computer in question. 
C)  locate as much incriminating information as possible. 
D)  preserve the photographs and video stored on the drive. 
E)  give priority to the text files on the drive. 
A)  do so without altering the drive in any way. 
B)  attempt to determine the owner of the computer in question. 
C)  locate as much incriminating information as possible. 
D)  preserve the photographs and video stored on the drive. 
E)  give priority to the text files on the drive.

Question 8

Sectors are typically ___________ bytes in size.

Accepted Answer

A)  512 
B)  256 
C)  126 
D)  2050 
E)  1024 
A)  512 
B)  256 
C)  126 
D)  2050 
E)  1024

Question 9

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

Accepted Answer

A)  a wired connection. 
B)  a wireless connection. 
C)  a satellite connection. 
D)  all of the above 
E)  A and B only 
A)  a wired connection. 
B)  a wireless connection. 
C)  a satellite connection. 
D)  all of the above 
E)  A and B only

Question 10

When is it necessary to make a "fingerprint" of a HDD?

Accepted Answer

A)  only sometimes 
B)  almost never 
C)  in most cases 
D)  before and after imaging its contents 
E)  rarely 
A)  only sometimes 
B)  almost never 
C)  in most cases 
D)  before and after imaging its contents 
E)  rarely

Question 11

Which of the following is the best definition of latent data?

Accepted Answer

A)  unallocated space 
B)  those data which are typically of little use to forensic investigators 
C)  anything readily available to the user, also known as visible data 
D)  those data that are hidden from view 
E)  an automatically saved copy of a file that was recently modified 
A)  unallocated space 
B)  those data which are typically of little use to forensic investigators 
C)  anything readily available to the user, also known as visible data 
D)  those data that are hidden from view 
E)  an automatically saved copy of a file that was recently modified

Question 12

The most commonly used feature of the Internet is:

Accepted Answer

A)  academic research. 
B)  chat rooms. 
C)  long-distance phone service. 
D)  email. 
E)  online shopping. 
A)  academic research. 
B)  chat rooms. 
C)  long-distance phone service. 
D)  email. 
E)  online shopping.

Question 13

Which of the following is NOT a type of RAM?

Accepted Answer

A)  DAB 
B)  SSIM 
C)  SD 
D)  DDIM 
E)  none of the above 
A)  DAB 
B)  SSIM 
C)  SD 
D)  DDIM 
E)  none of the above

Question 14

The two types of slack space are ___________ slack and ___________ slack.

Accepted Answer

A)  IP; TTI 
B)  unallocated: ROM 
C)  cluster; file 
D)  RAM; ROM 
E)  file; RAM 
A)  IP; TTI 
B)  unallocated: ROM 
C)  cluster; file 
D)  RAM; ROM 
E)  file; RAM

Question 15

The boot (start-up) process for a computer is controlled by:

Accepted Answer

A)  USB thumb drives. 
B)  RAM. 
C)  the hard disc drive. 
D)  Floppy discs. 
E)  ROM. 
A)  USB thumb drives. 
B)  RAM. 
C)  the hard disc drive. 
D)  Floppy discs. 
E)  ROM.

Question 16

The term bit is short for:

Accepted Answer

A)  binary digit. 
B)  database. 
C)  tidbit. 
D)  byte. 
E)  beneath image threshold. 
A)  binary digit. 
B)  database. 
C)  tidbit. 
D)  byte. 
E)  beneath image threshold.

Question 17

Once a file is deleted by a user, it:

Accepted Answer

A)  is obliterated from the system and cannot be recovered. 
B)  is retained until the disk space it occupies is allocated for another use. 
C)  may be identified using forensic image acquisition software. 
D)  A and B 
E)  B and C 
A)  is obliterated from the system and cannot be recovered. 
B)  is retained until the disk space it occupies is allocated for another use. 
C)  may be identified using forensic image acquisition software. 
D)  A and B 
E)  B and C

Question 18

A(n) ___________ is placed on a hard disk drive by a website to track certain information about its visitors.

Accepted Answer

A)  e-mail 
B)  cache 
C)  phish 
D)  IP address 
E)  cookie 
A)  e-mail 
B)  cache 
C)  phish 
D)  IP address 
E)  cookie

Question 19

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

Accepted Answer

A)  512 
B)  3,072 
C)  24,576 
D)  none of the above 
A)  512 
B)  3,072 
C)  24,576 
D)  none of the above

Question 20

Which of the following is NOT considered a hardware device?

Accepted Answer

A)  the random access memory 
B)  the operating system 
C)  the monitor 
D)  the mouse 
E)  the hard disk drive 
A)  the random access memory 
B)  the operating system 
C)  the monitor 
D)  the mouse 
E)  the hard disk drive

Describe how e-mails, chat and IM's can be traced and recovered by a computer forensics expert.

One gigabyte can be expressed as:

Unauthorized intrusion into a computer is called:

Which of the following is not considered to be classified as software?

The primary form of data storage within a personal computer is:

Hard drive partitions are typically divided into:

The ultimate goal of obtaining an image of a hard disk drive is to:

Sectors are typically ___________ bytes in size.

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

When is it necessary to make a "fingerprint" of a HDD?

Which of the following is the best definition of latent data?

The most commonly used feature of the Internet is:

Which of the following is NOT a type of RAM?

The two types of slack space are _ slack and _ slack.

The boot (start-up) process for a computer is controlled by:

The term bit is short for:

Once a file is deleted by a user, it:

A(n) ___________ is placed on a hard disk drive by a website to track certain information about its visitors.

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

Which of the following is NOT considered a hardware device?

Introduction

Securing and Searching the Crime Scene

Recording the Crime Scene

Collection of Crime-Scene Evidence

Physical Evidence

Death Investigation

Crime-Scene Reconstruction

Fingerprints

Firearms, Toolmarks, and Other Impressions

Bloodstain Pattern Analysis

Drugs

Forensic Toxicology

Trace Evidence I: Hairs and Fibers

Trace Evidence Ii: Paint, Glass, and Soil

Biological Stain Analysis: DNA

Forensic Aspects of Fire and Explosion Investigation

Document Examination

Filters

Exam 18: Computer Forensics

Describe how e-mails, chat and IM's can be traced and recovered by a computer forensics expert.

One gigabyte can be expressed as:

Unauthorized intrusion into a computer is called:

Which of the following is not considered to be classified as software?

The primary form of data storage within a personal computer is:

Hard drive partitions are typically divided into:

The ultimate goal of obtaining an image of a hard disk drive is to:

Sectors are typically ___________ bytes in size.

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

When is it necessary to make a "fingerprint" of a HDD?

Which of the following is the best definition of latent data?

The most commonly used feature of the Internet is:

Which of the following is NOT a type of RAM?

The two types of slack space are ___________ slack and ___________ slack.

The boot (start-up) process for a computer is controlled by:

The term bit is short for:

Once a file is deleted by a user, it:

A(n) ___________ is placed on a hard disk drive by a website to track certain information about its visitors.

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

Which of the following is NOT considered a hardware device?

Introduction

Securing and Searching the Crime Scene

Recording the Crime Scene

Collection of Crime-Scene Evidence

Physical Evidence

Death Investigation

Crime-Scene Reconstruction

Fingerprints

Firearms, Toolmarks, and Other Impressions

Bloodstain Pattern Analysis

Drugs

Forensic Toxicology

Trace Evidence I: Hairs and Fibers

Trace Evidence Ii: Paint, Glass, and Soil

Biological Stain Analysis: DNA

Forensic Aspects of Fire and Explosion Investigation

Document Examination

Filters

The two types of slack space are _ slack and _ slack.