Question 1

Describe how e-mails, chat and IM's can be traced and recovered by a computer forensics expert.

Accepted Answer

The answer of Describe how e-mails, chat and IM's can...

Question 2

One gigabyte can be expressed as:

Accepted Answer

A)  1,000 kilobytes (K
B) . 
B)  1,000 bytes. 
C)  1,000 megabytes (M
B) . 
D)  8,000 bits. 
E)  80,000 kilobytes (K
B) .

Question 3

Unauthorized intrusion into a computer is called:

Accepted Answer

A)  whacking. 
B)  spamming. 
C)  crashing. 
D)  hacking. 
E)  slamming.

Question 4

Which of the following is not considered to be classified as software?

Accepted Answer

A)  Floppy discs 
B)  Accounting applications 
C)  Web browsers 
D)  Operating systems 
E)  Word processors

Question 5

The primary form of data storage within a personal computer is:

Accepted Answer

A)  the CD-ROM. 
B)  a zip drive. 
C)  the hard disk drive. 
D)  a thumb drive. 
E)  the recycle bin.

Question 6

Hard drive partitions are typically divided into:

Accepted Answer

A)  Clusters 
B)  Sectors 
C)  Cylinders 
D)  Tracks 
E)  All of the above

Question 7

The ultimate goal of obtaining an image of a hard disk drive is to:

Accepted Answer

A)  do so without altering the drive in any way. 
B)  attempt to determine the owner of the computer in question. 
C)  locate as much incriminating information as possible. 
D)  preserve the photographs and video stored on the drive. 
E)  give priority to the text files on the drive.

Question 8

Sectors are typically ___________ bytes in size.

Accepted Answer

A)  512 
B)  256 
C)  126 
D)  2050 
E)  1024

Question 9

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

Accepted Answer

A)  a wired connection. 
B)  a wireless connection. 
C)  a satellite connection. 
D)  all of the above 
E)  A and B only

Question 10

When is it necessary to make a "fingerprint" of a HDD?

Accepted Answer

A)  only sometimes 
B)  almost never 
C)  in most cases 
D)  before and after imaging its contents 
E)  rarely

Question 11

Which of the following is the best definition of latent data?

Accepted Answer

A)  unallocated space 
B)  those data which are typically of little use to forensic investigators 
C)  anything readily available to the user, also known as visible data 
D)  those data that are hidden from view 
E)  an automatically saved copy of a file that was recently modified

Question 12

The most commonly used feature of the Internet is:

Accepted Answer

A)  academic research. 
B)  chat rooms. 
C)  long-distance phone service. 
D)  email. 
E)  online shopping.

Question 13

Which of the following is NOT a type of RAM?

Accepted Answer

A)  DAB 
B)  SSIM 
C)  SD 
D)  DDIM 
E)  none of the above

Question 14

The two types of slack space are ___________ slack and ___________ slack.

Accepted Answer

A)  IP; TTI 
B)  unallocated: ROM 
C)  cluster; file 
D)  RAM; ROM 
E)  file; RAM

Question 15

The boot (start-up) process for a computer is controlled by:

Accepted Answer

A)  USB thumb drives. 
B)  RAM. 
C)  the hard disc drive. 
D)  Floppy discs. 
E)  ROM.

Question 16

The term bit is short for:

Accepted Answer

A)  binary digit. 
B)  database. 
C)  tidbit. 
D)  byte. 
E)  beneath image threshold.

Question 17

Once a file is deleted by a user, it:

Accepted Answer

A)  is obliterated from the system and cannot be recovered. 
B)  is retained until the disk space it occupies is allocated for another use. 
C)  may be identified using forensic image acquisition software. 
D)  A and B 
E)  B and C

Question 18

A(n) ___________ is placed on a hard disk drive by a website to track certain information about its visitors.

Accepted Answer

A)  e-mail 
B)  cache 
C)  phish 
D)  IP address 
E)  cookie

Question 19

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

Accepted Answer

A)  512 
B)  3,072 
C)  24,576 
D)  none of the above

Question 20

Which of the following is NOT considered a hardware device?

Accepted Answer

A)  the random access memory 
B)  the operating system 
C)  the monitor 
D)  the mouse 
E)  the hard disk drive

Exam 18: Computer Forensics