Deck 23: Computer Forensics

Question 1

Only one person is needed to collect and document evidence obtained in performing forensics on a computer system.

Answer 1

False

Question 2

Generally speaking,you should back up the computer using DOS instead of Windows.

Answer 2

True

Question 3

Evidence offered by a witness that is not based on the personal knowledge of the witness,but is being offered to prove the truth of the matter asserted,fall under which rule of evidence?

A)Best evidence rule
B)Exclusionary rule
C)Hearsay rule
D)Relevant evidence rule

Answer 3

C

Question 4

When taking photographs for use as evidence,what type should be taken?

A)Digital camera pictures
B)Film with a high speed shutter
C)Film with a low speed shutter
D)Polaroid

Question 5

Evidence that is convincing or measures up without question is what standard of evidence?

A)Sufficient evidence
B)Competent evidence
C)Relevant evidence
D)Real evidence

Question 6

Evidence that is material to the case or has bearing on the matter at hand is what standard of evidence?

A)Sufficient evidence
B)Competent evidence
C)Relevant evidence
D)Real evidence

Question 7

What is a message digest?

A)It is a hash function that can be used to compare two files to see if they are identical.
B)A condensed version of the messages that the computer receives.
C)Messages that the computer sends to other computers
D)Availability protocol that establishes links to other computers.

Question 8

When performing forensics on a computer system you should use the utilities provided by that system.

Question 9

Tangible objects that prove or disprove fact are what type of evidence?

A)Direct evidence
B)Real evidence
C)Documentary evidence
D)Demonstrative evidence

Question 10

When analyzing computer storage components,the original system should be analyzed.

Question 11

Business records,printouts,and manuals are what type of evidence?

A)Direct evidence
B)Real evidence
C)Documentary evidence
D)Demonstrative evidence

Question 12

Clusters that are marked by the operating system as usable is referred to as which of the following?

A)Free space
B)Slack space
C)Open space
D)Unused space

Question 13

The term forensics relates to the application of ____________ knowledge to ___________ problems.

A)legal;computer
B)complete;software
C)scientific;legal
D)familiar;unfamiliar

Question 14

What is a software bomb?

A)A firework that destroys all the disks and CDs in your library
B)Any commands executed on the computer that have an adverse effect on the data being investigated
C)Screensavers that show fireworks going off
D)Software trying to access a computer

Question 15

Oral testimony that proves a specific fact with no inferences or presumptions is what type of evidence?

A)Hearsay
B)Real evidence
C)Direct evidence
D)Demonstrative evidence

Question 16

Which of the following has the least volatile data?

A)CPU storage
B)RAM
C)Hard drive
D)Kernel tables

Question 17

The recycle bin contains all the deleted files on a computer.

Question 18

What is the space in a cluster that is not occupied by a file called?

A)Free space
B)Slack space
C)Open space
D)Unused space

Question 19

What type of evidence is used to aid a jury and may be in the form of a model,experiment,chart,and so on,to indicate that an event occurred?

A)Direct evidence
B)Real evidence
C)Documentary evidence
D)Demonstrative evidence

Question 20

Which of the following rules applies to evidence obtained in violation of the Fourth Amendment of the Constitution?

A)Best evidence rule
B)Exclusionary rule
C)Hearsay rule
D)Evidentiary rule

Question 21

_______________ evidence refers to evidence in the form of business records,printouts,manuals and the like.

Question 22

What are the considerations when preserving evidence?

Question 23

The space that is left over in a cluster is called slack space.

Question 24

Evidence must meet the three standards of being sufficient,competent,and _______________.

Question 25

The cluster that holds the fragment of the original file is referred to as _______________,because the operating system has marked it as usable when needed.

Question 26

_______________ evidence refers to oral testimony that proves a specific fact.

Question 27

A(n)_______________ is the result of applying the hash function to data.

Question 28

What is the primary difference between free space and slack space?

Question 29

List at least three important considerations when you are transporting evidence from one location to another.

Question 30

What are three environmental factors that evidence needs to be protected from?

Question 31

_______________ performs a function similar to the familiar parity bits,checksum,or cyclical redundancy check (CRC).

Question 32

Relevant evidence must be convincing or measure up without question.

Question 33

To be credible in court proceedings,what are the three standards that evidence must meet?

Question 34

There are four different types of evidence: direct,real,documentary,and _______________.

Question 35

The _______________ refers to second-hand evidence.

Question 36

Oral testimony that proves a specific fact is considered real evidence.

Question 37

_______________ consists of documents,verbal statements,and material objects that are admissible in a court of law.

Question 38

Minor procedural missteps are not important provided the overall investigation is properly conducted.

Question 39

Evidence offered by the witness that is not based on the personal knowledge of the witness-but is being offered to prove the truth of the matter asserted-falls under the exclusionary rule.

Question 40

The term _______________ relates to the application of scientific knowledge to legal problems.