Deck 18: Computer Forensics

Question 1

What keeps track of the location of files and folders on the HDD?

A) the HDD itself
B) the CD-ROM
C) the FAT
D) the CPU
E) the search engine

Answer 1

C

Question 2

The ultimate goal of obtaining an image of a hard disk drive is to:

A) do so without altering the drive in any way.
B) attempt to determine the owner of the computer in question.
C) locate as much incriminating information as possible.
D) preserve the photographs and video stored on the drive.
E) give priority to the text files on the drive.

Answer 2

A

Question 3

When is it necessary to make a "fingerprint" of a HDD?

A) only sometimes
B) almost never
C) in most cases
D) before and after imaging its contents
E) rarely

Answer 3

D

Question 4

Which of the following is NOT considered a type of software?

A) Linux
B) Unix
C) Firefox
D) Random Access Memory
E) Excel

Question 5

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

A) tape each cable to its adjoining component in an effort to preserve the integrity of the physical connections.
B) procure a warrant to search.
C) document the scene.
D) remove the system to the laboratory for processing.
E) unplug every device from the CPU to preserve the hard disk drive.

Question 6

The primary form of data storage within a personal computer is:

A) the CD-ROM.
B) a zip drive.
C) the hard disk drive.
D) a thumb drive.
E) the recycle bin.

Question 7

A motherboard:

A) has a socket to accept RAM.
B) connects to every device used by the system.
C) is the main circuit board within a computer.
D) all of the above
E) none of the above

Question 8

A cluster is a group of ________ in multiples of ________.

A) cylinders, three
B) tracks, three
C) sectors, two
D) partitions, two
E) disks, four

Question 9

Evidentiary data may be recovered from which of the following?

A) RAM swap files
B) unallocated space on the HDD
C) slack space on the HDD
D) all of the above
E) none of the above

Question 10

One gigabyte can be expressed as:

A) 1,000 kilobytes (KB).
B) 1,000 bytes.
C) 1,000 megabytes (MB).
D) 8,000 bits.
E) 80,000 kilobytes (KB).

Question 11

Which of the following is NOT considered a hardware device?

A) the random access memory
B) the operating system
C) the monitor
D) the mouse
E) the hard disk drive

Question 12

Which of the following is NOT a type of RAM?

A) DAB
B) SSIM
C) SD
D) DDIM
E) none of the above

Question 13

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

A) Internet "cookies"
B) Internet history
C) cache
D) all of the above
E) A and B only

Question 14

One of the most common places to begin to look for evidential data is in:

A) any learn-to-type tutorial.
B) the spreadsheet files.
C) the word processing or text-based document files.
D) a CAD package.
E) a photograph editing program.

Question 15

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

A) a wired connection.
B) a wireless connection.
C) a satellite connection.
D) all of the above
E) A and B only

Question 16

Which of the following is NOT associated with the partitioning of a HDD?

A) cylinder
B) sector
C) track
D) quadrant
E) cluster

Question 17

Which of the following is the best definition of latent data?

A) unallocated space
B) those data which are typically of little use to forensic investigators
C) anything readily available to the user, also known as visible data
D) those data that are hidden from view
E) an automatically saved copy of a file that was recently modified

Question 18

The term bit is short for:

A) binary digit.
B) database.
C) tidbit.
D) byte.
E) beneath image threshold.

Question 19

A software algorithm used to create a "fingerprint" of a file or an entire HDD is called:

A) RAM.
B) MD5.
C) CPU.
D) ROM.
E) MAC OS.

Question 20

Once a file is deleted by a user, it:

A) is obliterated from the system and cannot be recovered.
B) is retained until the disk space it occupies is allocated for another use.
C) may be identified using forensic image acquisition software.
D) A and B
E) B and C

Question 21

A device that permits only requested traffic to enter a computer system is known as a(n) :

A) internet cache
B) network traffic manager
C) firewall
D) central processing unit (CPU)
E) cookie

Question 22

The two types of slack space are ___________ slack and ___________ slack.

A) IP; TTI
B) unallocated: ROM
C) cluster; file
D) RAM; ROM
E) file; RAM

Question 23

The ___________ is a complex network of wires that carry data from one hardware device to another.

A) network
B) central processing unit (CPU)
C) operating system
D) motherboard
E) hard disc drive

Question 24

All data readily available to a computer user is known as ___________ data.

A) visible
B) allocated
C) latent
D) slack
E) swap

Question 25

A(n) ___________ is placed on a hard disk drive by a website to track certain information about its visitors.

A) e-mail
B) cache
C) phish
D) IP address
E) cookie

Question 26

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

A) the BIOS.
B) system bus.
C) RAM.
D) ROM.
E) central processing unit.

Question 27

A directory or index cataloging the content of the Internet is called:

A) a web browser.
B) the world wide web.
C) a search engine.
D) an IPO.
E) a chat room.

Question 28

One should not look for "latent" data in:

A) RAM slack.
B) temporary files.
C) unallocated space.
D) file slack.
E) deleted files.

Question 29

List and describe the hardware and the software components of a computer.

Question 30

Unauthorized intrusion into a computer is called:

A) whacking.
B) spamming.
C) crashing.
D) hacking.
E) slamming.

Question 31

Which of the following actions taken at the crime scene involving a computer are incorrect?

A) upon arrival, sketching the overall layout as well as photographing it
B) photographing any running monitors
C) placing corresponding labels on cords from peripheral devices and the port to which each cord was connected
D) removing the plug from the back of the computer, not from the wall
E) none of the above

Question 32

Describe the difference between read-only memory and random-access memory.

Question 33

The boot (start-up) process for a computer is controlled by:

A) USB thumb drives.
B) RAM.
C) the hard disc drive.
D) Floppy discs.
E) ROM.

Question 34

Sectors are typically ___________ bytes in size.

A) 512
B) 256
C) 126
D) 2050
E) 1024

Question 35

The definition of software is:

A) primary component of storage in the personal computer
B) program permitting the user to manage files and applications
C) set of instructions compiled into a program that performs a particular task
D) storage programs used to start the boot process
E) a complex network of wires that carry data from one hardware device to another

Question 36

Which of the following is not considered to be classified as software?

A) Floppy discs
B) Accounting applications
C) Web browsers
D) Operating systems
E) Word processors

Question 37

One should not search for "visible" data in:

A) unallocated space.
B) swab files.
C) windows.
D) Quicken.
E) temporary files.

Question 38

The most commonly used feature of the Internet is:

A) academic research.
B) chat rooms.
C) long-distance phone service.
D) email.
E) online shopping.

Question 39

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

A) 512
B) 3,072
C) 24,576
D) none of the above

Question 40

Hard drive partitions are typically divided into:

A) Clusters
B) Sectors
C) Cylinders
D) Tracks
E) All of the above

Question 41

Describe how e-mails, chat and IM's can be traced and recovered by a computer forensics expert.

Question 42

Describe how a hard disk is partitioned.

Question 43

What are the areas of the computer that forensic examiners will examine to retrieve forensic data.

Question 44

List and describe three locations where forensic investigators may pinpoint the origin of a hacker.

Question 45

What is the difference between and location of visible and latent data?

Question 46

Describe the proper procedure for preserving computer evidence at a crime scene.

Question 47

Explain the various areas found on the computer where a user's Internet activities can be investigated.