Question 1

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

Accepted Answer

A) True 
 B)False

Question 2

A sound forensic practice is to make at least two copies of digital evidence and to confirm that at least one of the copies was successful and can be accessed on another computer.

Accepted Answer

A) True 
 B)False

Question 3

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

Accepted Answer

A) True 
 B)False

Question 4

At a crime scene, digital evidence will be found on the computer, on mobile devices, and on shelves, bookcases, and the area surrounding the computer. Therefore, there is no need to search the garbage for evidence.

Accepted Answer

A) True 
 B)False

Question 5

The updated ACPO recommendation for seizing a running computer is to pull the electrical cord from the back of the computer.

Accepted Answer

A) True 
 B)False

Question 6

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?

Accepted Answer

A)  Running processes 
B)  Open network ports 
C)  Data stored in memory 
D)  System date and time

Question 7

Which of the following is NOT one of the recommended approaches to preserving digital evidence?

Accepted Answer

A)  Place the evidential computers and storage media in secure storage for later processing. 
B)  Preview the evidential computer, taking appropriate notes. 
C)  Extract just the information needed from evidential computers and storage media. 
D)  Acquire everything from evidential computer and storage media.

Question 8

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

Accepted Answer

A) True 
 B)False

Question 9

Under independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, a reasonable compromise is to duplicate the

Accepted Answer

A) True 
 B)False

Question 10

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.

Accepted Answer

A)  Evidence inventory 
B)  Chain of custody 
C)  Evidence intake 
D)  Preservation notes

Question 11

"dd" is the only way to make a bitstream copy.

Accepted Answer

A) True 
 B)False

Exam 16: Applying Forensic Science to Computers

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

A sound forensic practice is to make at least two copies of digital evidence and to confirm that at least one of the copies was successful and can be accessed on another computer.

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

At a crime scene, digital evidence will be found on the computer, on mobile devices, and on shelves, bookcases, and the area surrounding the computer. Therefore, there is no need to search the garbage for evidence.

The updated ACPO recommendation for seizing a running computer is to pull the electrical cord from the back of the computer.

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?

Which of the following is NOT one of the recommended approaches to preserving digital evidence?

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

Under independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, a reasonable compromise is to duplicate the

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.

"dd" is the only way to make a bitstream copy.