Question 1

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.​

Accepted Answer

A) True 
 B)False  True

Question 2

Like most common law nations, the United States excludes hearsay as spelled out in the FRE Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can​ be used. Provide five examples that apply to digital forensics investigations.

Accepted Answer

Five examples of hearsay that can be used are:
•​Business records, including those of a public agency
•Certain public records and reports
•Evidence of the absence of a business record or entry
•Learned treatises used to question an expert witness
•Statement of the absence of a public record or entry

Question 3

The ______________ rule states that to prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required.

Accepted Answer

best evidence

Question 4

What type of media has a 30-year lifespan?​

Accepted Answer

A) ​DVD-Rs 
B) ​DLT magnetic tape 
C) hard drive 
D) USB thumb drive 
A) ​DVD-Rs 
B) ​DLT magnetic tape 
C) hard drive 
D) USB thumb drive

Question 5

Match the terms with the correct definitions?.
-Electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word-processing document

Accepted Answer

A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit 
A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 6

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.​

Accepted Answer

A) ​probable cause 
B) ​due diligence 
C) accusations 
D) reliability 
A) ​probable cause 
B) ​due diligence 
C) accusations 
D) reliability

Question 7

Describe the steps to take if you discover evidence of a crime during a company policy investigation​.

Accepted Answer

If you find evidence of a crime during a

Question 8

_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.

Accepted Answer

A) ​Second-party evidence 
B) ​Rumor 
C) Fiction 
D) Hearsay 
A) ​Second-party evidence 
B) ​Rumor 
C) Fiction 
D) Hearsay

Question 9

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

Accepted Answer

A) ​two 
B) ​five 
C) one 
D) three 
A) ​two 
B) ​five 
C) one 
D) three

Question 10

​As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

Accepted Answer

A) ​The power cable should be pulled. 
B) ​The system should be shut down gracefully. 
C) The power should be left on. 
D) The decision should be left to the Digital Evidence First Responder (DEFR). 
A) ​The power cable should be pulled. 
B) ​The system should be shut down gracefully. 
C) The power should be left on. 
D) The decision should be left to the Digital Evidence First Responder (DEFR).

Question 11

You must abide by the _______ while collecting evidence.

Accepted Answer

A) ​Fourth Amendment 
B) ​Federal Rules of Evidence 
C) state's Rules of Evidence 
D) Fifth Amendment 
A) ​Fourth Amendment 
B) ​Federal Rules of Evidence 
C) state's Rules of Evidence 
D) Fifth Amendment

Question 12

Match the terms with the correct definitions?.
-?Data the system maintains, such as system log files and proxy server logs

Accepted Answer

A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit 
A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 13

In the United States, ____________ and similar agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws, and make certain documents available as public records.

Accepted Answer

non-govern

Question 14

Compare and contrast hashing methods using a ​keyed hash set​ and a ​nonkeyed hash set​.

Accepted Answer

A nonkeyed hash set is a unique hash num

Question 15

Instead of producing hard disks in court, attorneys can submit ______ copies of files as evidence.​

Accepted Answer

The answer of Instead of producing hard disks in court,...

Question 16

​The plain view doctrine states that objects falling in the direct sight of an officer who has the right to be in a location are subject to seizure without a warrant and can be introduced into evidence. Provide the three criteria that must be met in order for the plain view doctrine to apply.

Accepted Answer

In order for the plain view doctrine to

Question 17

Match the terms with the correct definitions?.
-?A unique hash number generated by a software tool and used to identify files

Accepted Answer

A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit 
A) ?Computer-generated records 
B) Keyed hash set? 
C) ?Cyclic Redundancy Check 
D) ?Message Digest 5 
E) ?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 18

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?​

Accepted Answer

A) United States v. Wong​ 
B) ​United States v. Carey 
C) United States v. Salgado 
D) United States v. Walser 
A) United States v. Wong​ 
B) ​United States v. Carey 
C) United States v. Salgado 
D) United States v. Walser

Question 19

_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.

Accepted Answer

A) ​Hospitals 
B) ​ISPs 
C) Law firms 
D) News networks 
A) ​Hospitals 
B) ​ISPs 
C) Law firms 
D) News networks

Question 20

When seizing digital evidence in criminal investigations, whose standards should be followed??

Accepted Answer

A) ?U.S. DOJ 
B) ISO?/ IEC? 
C) IEEE 
D) ITU 
A) ?U.S. DOJ 
B) ISO?/ IEC? 
C) IEEE 
D) ITU

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.

Like most common law nations, the United States excludes hearsay as spelled out in the FRE Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can be used. Provide five examples that apply to digital forensics investigations.

The ______________ rule states that to prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required.

What type of media has a 30-year lifespan?

Match the terms with the correct definitions?. -Electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word-processing document

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.

Describe the steps to take if you discover evidence of a crime during a company policy investigation.

_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

You must abide by the _______ while collecting evidence.

Match the terms with the correct definitions?. -?Data the system maintains, such as system log files and proxy server logs

In the United States, ____________ and similar agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws, and make certain documents available as public records.

Compare and contrast hashing methods using a keyed hash set and a nonkeyed hash set.

Instead of producing hard disks in court, attorneys can submit ______ copies of files as evidence.

The plain view doctrine states that objects falling in the direct sight of an officer who has the right to be in a location are subject to seizure without a warrant and can be introduced into evidence. Provide the three criteria that must be met in order for the plain view doctrine to apply.

Match the terms with the correct definitions?. -?A unique hash number generated by a software tool and used to identify files

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?

_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.

When seizing digital evidence in criminal investigations, whose standards should be followed??

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 4: Processing Crime and Incident Scenes

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.​

Like most common law nations, the United States excludes hearsay as spelled out in the FRE Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can​ be used. Provide five examples that apply to digital forensics investigations.

The ______________ rule states that to prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required.

What type of media has a 30-year lifespan?​

Match the terms with the correct definitions?. -Electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word-processing document

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.​

Describe the steps to take if you discover evidence of a crime during a company policy investigation​.

_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

​As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

You must abide by the _______ while collecting evidence.

Match the terms with the correct definitions?. -?Data the system maintains, such as system log files and proxy server logs

In the United States, ____________ and similar agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws, and make certain documents available as public records.

Compare and contrast hashing methods using a ​keyed hash set​ and a ​nonkeyed hash set​.

Instead of producing hard disks in court, attorneys can submit ______ copies of files as evidence.​

​The plain view doctrine states that objects falling in the direct sight of an officer who has the right to be in a location are subject to seizure without a warrant and can be introduced into evidence. Provide the three criteria that must be met in order for the plain view doctrine to apply.

Match the terms with the correct definitions?. -?A unique hash number generated by a software tool and used to identify files

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?​

_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.

When seizing digital evidence in criminal investigations, whose standards should be followed??

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.

Like most common law nations, the United States excludes hearsay as spelled out in the FRE Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can be used. Provide five examples that apply to digital forensics investigations.

What type of media has a 30-year lifespan?

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.

Describe the steps to take if you discover evidence of a crime during a company policy investigation.

As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

Compare and contrast hashing methods using a keyed hash set and a nonkeyed hash set.

Instead of producing hard disks in court, attorneys can submit ______ copies of files as evidence.

The plain view doctrine states that objects falling in the direct sight of an officer who has the right to be in a location are subject to seizure without a warrant and can be introduced into evidence. Provide the three criteria that must be met in order for the plain view doctrine to apply.

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?