Deck 10: Acquisition and Examination of Forensic Evidence

Question 1

What is the name for the device that allows read-only access to all accessible data on a drive and keeps anything from being written to an original drive?

A) wiping tool
B) write-blocker
C) EnCase
D) Cell-brite

Answer 1

B

Question 2

What US government agency operates the Computer Forensic Tool Testing Project?

A) National Institute of Standards and Technology (NIST)
B) National Security Agency (NSA)
C) Internet Crime Complaint Center (IC3)
D) Action Fraud

Answer 2

A

Question 3

Which of the following is not a specific criteria identified for imaging tools by NIST?

A) the tool shall log I/O errors
B) tools shall not alter the original disk
C) tools shall be affordable
D) tools shall make a duplicate or image of an original disk

Answer 3

C

Question 4

What is the term used to refer to the organization of a hard drive into separate storage spaces?

A) extracting
B) partitioning
C) wiping
D) carving

Question 5

What is the term used to refer to files that have been manipulated in order to conceal the contents of the original file?

A) cleaned files
B) wiped files
C) deleted files
D) hidden files

Question 6

What is the term used to refer to the copy and capture of original data files in a way that makes them available for analyses that minimizes the likelihood of error?

A) preservation
B) instant process
C) carving
D) wiping

Question 7

When an examiner validates that the hard drive image they are working with is an authentic duplicate of the original, they use a unique algorithm to generate a:

A) copy
B) digi-bit
C) hash value
D) partitioned file

Question 8

What phrase references the process of searching for files and extracting that data without considering the larger file systems?

A) file signature
B) wiping
C) partitioning
D) file carving