Question 1

One of the most important things to establish when a computer is directly involved in the commission of a crime is:

Accepted Answer

A)   Where the computer was purchased
B)   What operating system is in use
C)   Who or what was the intended victim or target
D)   None of the above C

Question 2

When assessing the risk of a target computer, investigators should determine if the offender needed a high level of skill.

Accepted Answer

A) True 
 B)False  True

Question 3

An example of online behavior that puts an individual at higher risk for cyberstalking is:

Accepted Answer

A)   Using your real name online
B)   Putting personal information in your profile
C)   Posting photographs on a social networking page
D)   All of the above D

Question 4

Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?

Accepted Answer

A)   Functional
B)   Intentional
C)   Relational
D)   Temporal

Question 5

The machine with an old operating system, no patches, and many services running, located on an unprotected network, containing valuable information, and with a history of intrusions or intrusion attempts, is at low risk of being broken into.

Accepted Answer

A) True 
 B)False

Question 6

The investigation and study of victim characteristics is known as:

Accepted Answer

A)   Criminal profiling
B)   Behavioral imprints
C)   Victimology
D)   Crime scene analysis

Question 7

When a computer is the target of an attack, it is also useful to determine if the system was at high or low risk of being targeted.

Accepted Answer

A) True 
 B)False

Question 8

Victimology is the investigation and study of victim characteristics.

Accepted Answer

A) True 
 B)False

Question 9

The temporal form of investigative reconstruction helps identify event sequences and patterns.

Accepted Answer

A) True 
 B)False

Question 10

A threshold assessment report may have a similar structure to a full investigative report but includes more details and has firmer conclusions based on all the evidence available.

Accepted Answer

A) True 
 B)False

Question 11

Threshold assessments have eliminated the need for digital investigators to write full reports.

Accepted Answer

A) True 
 B)False

Question 12

Although it is possible that the Internet can significantly increase the victim's risk, it is not necessary for victimology to include a thorough search for cybertrails.

Accepted Answer

A) True 
 B)False

Question 13

The process of evaluating available evidence objectively, independent of the interpretations of others, to determine its true meaning is referred to as:

Accepted Answer

A)   Equivocal forensic analysis
B)   Investigative reconstruction
C)   Threshold assessment
D)   Behavioral imprints

Question 14

Forensic analysis and reconstruction only include evidence that was left at a crime scene and are intrinsically limited.

Accepted Answer

A) True 
 B)False

Question 15

Because seemingly minor details regarding the offender can be important, investigators should get into the habit of contemplating which of the following:

Accepted Answer

A)   What the offender brought to the crime scene
B)   What the offender took from the crime scene
C)   What the offender changed at the crime scene
D)   All of the above

Question 16

In the movie Home Alone one of the burglars would always turn the water on in the sinks so that the house would be flooded when the owners returned. In terms of crime scene characteristics, this is an example of:

Accepted Answer

A)   Psychotic episode
B)   Signature-oriented behavior
C)   Modus operandi
D)   Vandalism

Question 17

The functional form of investigative reconstruction answers the questions "Who?" "What?" and "Where?"

Accepted Answer

A) True 
 B)False

Question 18

Different offenders can use the same method of approach for control for very different reasons; however, it is possible to make reliable generations on the basis of individual crime scene characteristics.

Accepted Answer

A) True 
 B)False

Question 19

Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?

Accepted Answer

A)   Functional
B)   Intentional
C)   Relational
D)   Temporal

Question 20

Among the more informative aspects of the offender-victim relationships are victim risk and the effort than an offender was willing to make to access a specific victim.

Accepted Answer

A) True 
 B)False

Exam 8: Investigative Reconstruction With Digital Evidence

One of the most important things to establish when a computer is directly involved in the commission of a crime is:

When assessing the risk of a target computer, investigators should determine if the offender needed a high level of skill.

An example of online behavior that puts an individual at higher risk for cyberstalking is:

Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?

The machine with an old operating system, no patches, and many services running, located on an unprotected network, containing valuable information, and with a history of intrusions or intrusion attempts, is at low risk of being broken into.

The investigation and study of victim characteristics is known as:

When a computer is the target of an attack, it is also useful to determine if the system was at high or low risk of being targeted.

Victimology is the investigation and study of victim characteristics.

The temporal form of investigative reconstruction helps identify event sequences and patterns.

A threshold assessment report may have a similar structure to a full investigative report but includes more details and has firmer conclusions based on all the evidence available.

Threshold assessments have eliminated the need for digital investigators to write full reports.

Although it is possible that the Internet can significantly increase the victim's risk, it is not necessary for victimology to include a thorough search for cybertrails.

The process of evaluating available evidence objectively, independent of the interpretations of others, to determine its true meaning is referred to as:

Forensic analysis and reconstruction only include evidence that was left at a crime scene and are intrinsically limited.

Because seemingly minor details regarding the offender can be important, investigators should get into the habit of contemplating which of the following:

In the movie Home Alone one of the burglars would always turn the water on in the sinks so that the house would be flooded when the owners returned. In terms of crime scene characteristics, this is an example of:

The functional form of investigative reconstruction answers the questions "Who?" "What?" and "Where?"

Different offenders can use the same method of approach for control for very different reasons; however, it is possible to make reliable generations on the basis of individual crime scene characteristics.

Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?

Among the more informative aspects of the offender-victim relationships are victim risk and the effort than an offender was willing to make to access a specific victim.