Deck 8: Investigative Reconstruction With Digital Evidence

Question 1

Why should victimology include a thorough search of the Internet for cybertrails?

A) Because the Internet can significantly increase the victims risk.
B) Because it is well known that even traditional criminal offenses are documented on the Internet.
C) Because nearly everyone uses the Internet.
D) None of the above.

Answer 1

A

Question 2

In the movie Home Alone one of the burglars would always turn the water on in the sinks so that the house would be flooded when the owners returned. In terms of crime scene characteristics, this is an example of:

A) Psychotic episode
B) Signature-oriented behavior
C) Modus operandi
D) Vandalism

Answer 2

B

Question 3

An example of online behavior that puts an individual at higher risk for cyberstalking is:

A) Using your real name online
B) Putting personal information in your profile
C) Posting photographs on a social networking page
D) All of the above

Answer 3

D

Question 4

Minor details regarding the offender are unimportant, and can safely be ignored.

Question 5

Investigative reconstruction can be used to locate concealed evidence.

Question 6

Because seemingly minor details regarding the offender can be important, investigators should get into the habit of contemplating which of the following:

A) What the offender brought to the crime scene
B) What the offender took from the crime scene
C) What the offender changed at the crime scene
D) All of the above

Question 7

The totality of choices an offender makes during the commission of a crime are referred to as:

A) The criminal's MO
B) Crime scene characteristics
C) Tangible evidence
D) None of the above

Question 8

The type of report that is a preliminary summary of findings is known as:

A) SITREP
B) Threshold Assessment report
C) Full investigative report
D) Field notes

Question 9

The investigation and study of victim characteristics is known as:

A) Criminal profiling
B) Behavioral imprints
C) Victimology
D) Crime scene analysis

Question 10

Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?

A) Functional
B) Intentional
C) Relational
D) Temporal

Question 11

"Investigative reconstruction" refers to the systematic process of piecing together evidence and information gathered during an investigation to gain a better understanding of what transpired between the victim and the offender during a crime.

Question 12

The words that an offender uses on the Internet, the tools that an offender uses online, and how an offender conceals his identity and criminal activity are referred to in the text as:

A) Investigation reconstruction
B) Threshold assessment
C) Behavioral imprints
D) Crime scene analysis

Question 13

In crimes against individuals the period leading up to the crime often contains the most important clues regarding the relationship between the offender and the victim.

A) 24-hour
B) 48- hour
C) 60-minute
D) 15-minute

Question 14

The temporal form of investigative reconstruction helps identify event sequences and patterns.

Question 15

The process of evaluating available evidence objectively, independent of the interpretations of others, to determine its true meaning is referred to as:

A) Equivocal forensic analysis
B) Investigative reconstruction
C) Threshold assessment
D) Behavioral imprints

Question 16

Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?

A) Functional
B) Intentional
C) Relational
D) Temporal

Question 17

The functional form of investigative reconstruction answers the questions "Who?" "What?" and "Where?"

Question 18

One of the most important things to establish when a computer is directly involved in the commission of a crime is:

A) Where the computer was purchased
B) What operating system is in use
C) Who or what was the intended victim or target
D) None of the above

Question 19

According to the text, the distinguishing features of a crime scene as evidenced by the offender's behavioral decisions regarding the victim and the offense location are known as:

A) Hard evidence
B) Fruit of the poison tree
C) Caveat emptor
D) Crime scene characteristics

Question 20

One reason digital investigators write threshold assessments more often than full reports is because:

A) They will be included in a final report, and so, distribute the time for final report preparation over the entire period of the investigation.
B) They keep their supervisor aware of their productivity.
C) They take less time to prepare and may be sufficient to close out an investigation.
D) They serve as field notes for the investigator.

Question 21

Although it is possible that the Internet can significantly increase the victim's risk, it is not necessary for victimology to include a thorough search for cybertrails.

Question 22

Different offenders can use the same method of approach for control for very different reasons; however, it is possible to make reliable generations on the basis of individual crime scene characteristics.

Question 23

Victimology is the investigation and study of victim characteristics.

Question 24

Threshold assessments have eliminated the need for digital investigators to write full reports.

Question 25

Among the more informative aspects of the offender-victim relationships are victim risk and the effort than an offender was willing to make to access a specific victim.

Question 26

The machine with an old operating system, no patches, and many services running, located on an unprotected network, containing valuable information, and with a history of intrusions or intrusion attempts, is at low risk of being broken into.

Question 27

When a computer is the target of an attack, it is also useful to determine if the system was at high or low risk of being targeted.

Question 28

When assessing the risk of a target computer, investigators should determine if the offender needed a high level of skill.

Question 29

Forensic analysis and reconstruction only include evidence that was left at a crime scene and are intrinsically limited.

Question 30

A threshold assessment report may have a similar structure to a full investigative report but includes more details and has firmer conclusions based on all the evidence available.

Question 31

Explain why an offender's choice of weapon is significant to an investigation.

Question 32

Explain why it can be difficult to determine if someone took a copy of a digital file.