Deck 16: Applying Forensic Science to Computers

Question 1

If it is determined that some hardware should be collected, but there is no compelling need to collect everything, the most sensible approach is to employ:

A) Nearest reach doctrine
B) Direct connectivity doctrine
C) Independent component doctrine
D) Slice-the-pie doctrine

Answer 1

C

Question 2

The forensic crime scene processing kit should include all of the following, EXCEPT:

A) Evidence bags, tags, and other items to label and package evidence
B) Forensically sanitized hard drives to store acquired data
C) Compilers for developing forensic tools on site
D) Hardware write blockers

Answer 2

C

Question 3

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

Answer 3

False

Question 4

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.

A) Evidence inventory
B) Chain of custody
C) Evidence intake
D) Preservation notes

Question 5

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?

A) Running processes
B) Open network ports
C) Data stored in memory
D) System date and time

Question 6

A forensic crime scene processing kit should contain quantities of those items used to process computer equipment.

Question 7

When documenting a crime scene, the computer and surrounding area should be photographed, detailed sketches should be made, and copious notes should be taken, because:

A) The more evidence collected, the stronger the case.
B) This provides a record for what to look for when you return for the second visit.
C) It is prudent to document the same evidence in several ways.
D) All of the above.

Question 8

When processing the digital crime scene, one aspect of surveying for potential sources of digital evidence is:

A) Recognizing relevant hardware such as computers, removable media, etc.
B) Determining if electrical wiring is capable of supporting forensic machines
C) Confirming that the operating environment is suitable for electronic equipment
D) Making sure there is sufficient space to set up the forensic crime scene processing kit

Question 9

Which of the following is NOT one of the recommended approaches to preserving digital evidence?

A) Place the evidential computers and storage media in secure storage for later processing.
B) Preview the evidential computer, taking appropriate notes.
C) Extract just the information needed from evidential computers and storage media.
D) Acquire everything from evidential computer and storage media.

Question 10

Which of the following is NOT part of the set of forensic methodologies referenced in this book?

A) Preparation
B) Interdiction
C) Documentation
D) Reconstruction

Question 11

Preparation planning prior to processing a crime scene should include:

A) What computer equipment to expect at the site
B) What the systems are used for
C) Whether a network is involved
D) All of the above

Question 12

The reason UNIX "dd" is considered a de facto standard for making bitstream copies is:

A) The majority of tools for examining digital evidence can interpret bitstream copies.
B) "dd" stands for "digital data" and was developed for making forensic copies.
C) "dd," although a UNIX tool, is universally able to traverse Windows file systems.
D) The developers of "dd" have made arrangements with other forensic software companies.

Question 13

A crime scene investigator decides to collect the entire computer. In addition, he decides to collect all of the peripheral devices associated with that computer. What reason could he give to justify this?

A) It is especially important to collect peripheral hardware related to the type of digital evidence one would expect to find in the computer.
B) Since the computer is being collected, the suspect has no need for the peripherals.
C) The presence of the peripheral devices is essential to imaging the suspect hard drive.
D) None of the above.

Question 14

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

Question 15

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

Question 16

The file signature of a Microsoft Word document is an example of what type of characteristic?

A) An individual characteristic
B) A class characteristic
C) An intermediate characteristic
D) A medial characteristic

Question 17

In regard to preservation, in a child pornography investigation, which of the following should be collected?

A) Photographs
B) Papers
C) Digital cameras
D) All of the above

Question 18

Regarding the examination of a piece of digital evidence, which of the following is NOT one of the fundamental questions that need to be answered?

A) What is it (identification)?
B) What classifications distinguish it?
C) Where did it come from?
D) What is its value?

Question 19

According to the us Federal guidelines for searching and seizing computers, safe temperature ranges for most magnetic media are:

A) 60-80 degrees Fahrenheit
B) 50-90 degrees centigrade
C) 50-90 degrees Fahrenheit
D) 60-80 degrees centigrade

Question 20

Since computer seizures usually happen pretty much the same way, there is no real need to do any pre-planning.

Question 21

The severity and the category of cybercrime largely determine how much digital evidence is collected.

Question 22

The updated ACPO recommendation for seizing a running computer is to pull the electrical cord from the back of the computer.

Question 23

A sound forensic practice is to make at least two copies of digital evidence and to confirm that at least one of the copies was successful and can be accessed on another computer.

Question 24

When a computer is to be moved or stored, evidence tape should be put around the main components of the computer in such a way that any attempt to open the casing or use the computer will be evident.

Question 25

"dd" is the only way to make a bitstream copy.

Question 26

At a crime scene, digital evidence will be found on the computer, on mobile devices, and on shelves, bookcases, and the area surrounding the computer. Therefore, there is no need to search the garbage for evidence.

Question 27

Given the risks of collecting a few files only, in most cases it is advisable to preserve the full contents of the disk.

Question 28

Under independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, a reasonable compromise is to duplicate the

Question 29

It is not prudent to document the evidence more than one way.

Question 30

Computers used to store and analyze digital evidence should be connected to the Internet, so that online research can be conducted.

Question 31

List the class and individual characteristics of each of the following:
- A JPEG file
- A thumb drive
- A user manual with handwritten notes