Issuu

Guide to Computer Forensics and Investigations 7e Bill Nelson, Amelia Phillips, Christopher Steuart (Test Bank All Chapters, 100% Original Verified, A+ Grade) Mod 01: Understanding the Digital Forensics Profession and Investigations 1. Mahmood is examining a device for digital evidence. There are two types of evidence he is looking for.

Which type of evidence will prove that his client is not guilty? a. Inculpatory evidence b. Exculpatory evidence c. Miaculpatory evidence d. Discretionary evidence ANSWER: RATIONALE:

Mahmood is looking for exculpatory evidence which is evidence that tends to show that a defendant is not guilty of the crime they have been charged with. This type of evidence can help to exonerate or clear the defendant of the charges. Exculpatory evidence can include physical evidence, witness statements, or other types of evidence that support the defendant's innocence.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.1 - Describe the field of digital forensics TOPICS: An Overview of Digital Forensics KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 2. What are the main differences between public-sector investigations and private-sector investigations? a. Private-sector investigations involve government agencies responsible for criminal investigations and

prosecution. Public-sector investigations focus more on policy violations. b. Private-sector investigations can become criminal investigations and public-sector investigations can become civil investigation depending upon the circumstances. c. Public-sector investigations involve government agencies responsible for criminal investigations and prosecution. Private-sector investigations focus more on policy violations. d. The private sector can ignore criminal investigations, and the public sector can ignore civil investigations. ANSWER: RATIONALE:

b, c

POINTS: QUESTION TYPE:

1 Multiple Response

In general, the main difference between public-sector and private sector investigations is that the public-sector investigations involve government agencies responsible for criminal investigations and prosecution. Government agencies range from municipal, county, and state or provincial police departments to federal law enforcement agencies. These organizations must observe legal guidelines of their jurisdictions. Private-sector investigations focus more on policy violations. However, criminal acts, such as corporate espionage, can also occur. So, although private-sector investigations often start as civil cases, they can develop into criminal cases; likewise, a criminal case can have implications leading to a civil case.

Page 1

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.2 - Explain how to prepare for computer investigations and summarize the difference between public-sector and private-sector investigations TOPICS: Preparing for Digital Investigations KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 3. When conducting a computer investigation for potential criminal violations of the law, the legal processes

you follow depend on local customs, legislative standards, and rules of evidence. In general, however, a criminal case follows three stages. What are those three stages? a. Complaint, the investigation, and the prosecution b. Complaint, discovery, and the trial c. Complaint, service of process, and motions d. Complaint, answer, discovery, and trial ANSWER: RATIONALE:

If it has been determined that a crime has been committed, it is sent to the prosecutor to prosecute the case. Hence, there is a complaint, an investigation, and then the prosecution.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.2 - Explain how to prepare for computer investigations and summarize the difference between public-sector and private-sector investigations TOPICS: Preparing for Digital Investigations KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 4. You're the head of the executive management committee and as part of your corporate governance duties you

must implement a policy to define and limit who has authorization to request a computer investigation and forensics analysis (authorized requestor). Which group or groups should have the authority to request a computer investigation? a. The human resources department b. The corporate ethics office c. The general counsel or legal department d. The accounting department ANSWER: RATIONALE:

b, c

The reason the corporate ethics office and general counsel's office should only be involved in authorizing investigations is that other groups within the organization might create false allegations of misconduct to prevent competing departments from delivering a proposal for the same source of funds.

Page 2

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.2 - Explain how to prepare for computer investigations and summarize the difference between public-sector and private-sector investigations TOPICS: Preparing for Digital Investigations KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 5. Allen works for a small newspaper. There is no corporate security investigations group, no written or verbal

acceptable use policy, and the publisher (owner) owns the rights to all the computer hardware and software. One day, the publisher calls him into the office and asks him to help them with an email problem. Upon fixing the problem Allen discovers that there are illicit photos (no one was underage) on the publisher's laptop. The publisher later asks Allen to sanitize the laptop because the publisher wants to give it to their grandson. Allen must go through the laptop to find all the photos. What can Allen do to stop this work behavior? a. Report the publisher to Human Resources b. File a hostile work environment claim c. Sanitize the laptop and do nothing else d. Refuse to do the job ANSWER: RATIONALE:

In this situation, no laws are broken. There is no written or verbal acceptable use policy so there is no legal recourse for the publisher's actions other than Allen filing a claim citing a hostile work environment.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.2 - Explain how to prepare for computer investigations and summarize the difference between public-sector and private-sector investigations TOPICS: Preparing for Digital Investigations KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 6. As head of Zenon's corporate IT department, Naya is tasked with analyzing the corporate mobile device

policy. She needs to decide which is better, company owned mobile devices or BYOD? As a member of the corporate security team, Naya asks you for advice on which you think will be more appropriate. When you examine all options, which environment do you think works best for Zenon? a. With company owned devices, it falls on the employee to keep them updated. b. With company owned devices, all apps, files, and email can be secured. c. With BYOD employees own the devices so companies are not liable if anything happens to the

device. Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations d. With BYOD, the employee buys the device, and the company can lock it down (mobile device

management). ANSWER: RATIONALE:

b, d

The issues relating to BYOD versus company owned devices have been argued amongst corporate IT managers for years. On the one hand, having a BYOD policy frees companies from having to purchase smart phones for employees and saves them money. But on the other hand, having a corporate owned device means a more secure environment. It is a matter of corporate policy that determines what the smart phone policy is.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.2 - Explain how to prepare for computer investigations and summarize the difference between public-sector and private-sector investigations TOPICS: Preparing for Digital Investigations KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 7. Thanks to the dark web, anybody can access computer programs that will help users exfiltrate (remove) data

from any type of computer or network. Because of this activity, white-collar crime and industrial espionage are on the rise. How does white-collar-crime compare to industrial espionage? a. White-collar crime refers to financial crimes committed in a business or professional setting, while

espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity. b. Espionage refers to financial crimes committed in a business or professional setting, while white collar crime refers to the unauthorized sharing of confidential information to a competitor or foreign entity. c. White-collar crime is the same as espionage and are both punishable offenses. d. White-collar crime and espionage are victimless crimes. ANSWER: RATIONALE:

The cost of white-collar crime and espionage to companies can vary greatly and is difficult to quantify with precision. However, the fiscal impact can be substantial and goes far beyond financial losses. However, in general white-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

Page 4

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations KEYWORDS: DATE CREATED: DATE MODIFIED:

Bloom's: Analyze/Create/Evaluate 4/18/2024 2:41 PM 4/18/2024 2:41 PM

8. Kwan is a Digital Evidence Specialist and is looking for a new job. He has an immaculate resume, fantastic

references, and an excellent work history. But on the weekends, he likes to go out and get drunk, play beer pong, get high, and to post a lot of selfies to his social media sites. Recently, he applied to Jaffe Corporation for a Digital Evidence Specialist position. The interview went well. In fact, Jaffe is looking to hire him for a project, but upon further investigation, they decide not to. What might the deciding factor have been in Jaffe Corp. not hiring Kwan? a. Kwan should put all his social media platform settings on private so no one can see his pictures. b. Kwan can do whatever he wants. What he does with his own time should not affect him

professionally. c. Kwan's selfies of getting drunk and high show a critical lack of judgment. Those images could allow an opposing attorney to discredit him due to his behavior. d. Kwan can control what pictures of him are put on the Internet. ANSWER: RATIONALE:

In today's world, getting drunk or high may not be illegal, but when working in the legal field, flaunting it shows a lack of character and judgment. Doing so could allow an opposing attorney to discredit Kwan for his behavior. Any image that represents Kwan can be used against him professionally. Kwan cannot control what pictures of him end up on the Internet; he can only control his behavior.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.3 - Explain the importance of maintaining professional conduct TOPICS: Maintaining Professional Conduct KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 9. Lucy needs to make a forensic initial assessment about a case she is investigating. What are some of the steps

she needs to take for the assessment? a. Has law enforcement apprehended a suspect? b. Have law enforcement or company security officers already seized the computer, disks, peripherals,

and other components? c. Was a computer or a laptop found? d. Is the president of the company available? ANSWER: RATIONALE:

Lucy needs to identify, preserve, and analyze digital evidence that may be relevant to an investigation. So it is important that she knows if computers, disks, peripherals, and other components have been seized, and if they are safely within the chain-of-

Page 5

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations

custody. Then, Lucy can begin her investigation. POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 10. Carmon needs to determine what the preliminary approach to a case should be. What are some of the general

steps she needs to follow to investigate the case? a. Create a detailed check list, determine resources you need, obtain, and copy an evidence drive b. Check fingerprint databases, search rainbow tables, speak with police personnel c. Identify suspects, check the DMV, talk to crime scene investigators for evidence that might have

been missed d. Identify the risks, mitigate, or minimize the risks, test the design, investigate the data recovered ANSWER: RATIONALE:

a, d

Carmon's approach to the case should be to; determine the resources she needs, obtain, and copy the evidence drive, identify the risks, mitigate or minimize the risks, test the design, analyze and recover the digital evidence, investigate the data she recovers, complete the case report, and critique the case.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 11. Joe has been tasked with investigating an incident at Zander Corp. What is the first rule he must follow that

is important for all investigations, no matter how big or small? a. Categorizing the evidence b. Stabilizing the evidence c. Preserve the evidence d. Detain the evidence ANSWER: RATIONALE:

Joe must preserve the evidence. This is the first rule for all investigations. It refers to

Page 6

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations

the overall process of collecting, documenting, and maintaining evidence so that it can be used as evidence in a legal proceeding or investigation. POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 12. Jennifer is about to take over a computer crime case at Amcore lab. Before she begins, must verify that the

chain of custody has not been broken. She discovers that the seal on the container on the suspect's hard drive has been broken and there is no signature on the sign out sheet that someone took the hard drive for analysis. How does this affect the chain of custody? a. It does nothing to the chain of custody. b. It only affects authenticity. c. It breaks the chain of custody. d. The custody of the data's journey is now refutable but can still be admissible. ANSWER: RATIONALE:

The chain of custody has been broken. It is not known if the data on the hard drive has been corrupted or manipulated. Multiple hard drives located in the same facility could be called into question because an attorney could hypothesize that those hard drives have also been corrupted or manipulated.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 13. Akikta has been given a Windows 10 computer that needs to be investigated. Mostly, he will be recovering

deleted files, and checking unallocated space on the hard drive. What are some software Akikta may want to use? a. FTK Imager, X-Ways Forensics, and dd b. EnCase, FTK, and Autopsy c. Photorec and Scalpel d. md5sum and sha256sum Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations ANSWER: RATIONALE:

b, c

Akika would use EnCase, FTK, and Autopsy to recover deleted files and Photorec and Scalpel, which are file carving tools, to look for unallocated space on the hard drive.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 14. Kailani is about to take possession of a Windows 2000 computer for forensic investigation. Why must

Kailani use older forensic tools for this Windows 2000 computer? a. Windows 2000 is too advanced b. Windows 2000 is a legacy system c. Windows 2000 is no longer used in production networks d. Windows 2000 no longer works ANSWER: RATIONALE:

Windows 2000 is a legacy system and is still used in some instances. Not all modern tools will work with it. However, tools like ForensiX and SMART are still available for use with Windows 2000 for data acquisition.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 15. Ethel is transporting a computer to her forensic lab, and she needs to secure the device before transport.

What does Ethel need to do to ensure that the computer maintains chain of custody and arrives intact at her lab? a. Put the entire tower or laptop in a Faraday box or bag b. Transport the drives in separate vehicles from the tower or laptop c. Place evidence tape over drive bays and insertion slots for power supply cords and USB cables d. Place everything in her trunk and lock it so it can't be stolen ANSWER:

c, d

Page 8

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations RATIONALE:

To transport the computer to her forensics lab, Ethel must seal off the device by placing evidence tape over drive bays and plug insertion slots as well as write her name on the evidence tape sealing the device. If the tape is removed or broken, so is her name, meaning the seal has been broken.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 16. Ha-Yoon must do a risk assessment for a client. The client has an employee who does not know computers

very well but has recently been taking classes on computer hacking. He has been spending more time on his computer and less time working. Recently their network has seen more traffic and attempted breaches than usual. There is no acceptable use policy in place. What should Ha-Yoon recommend first to mitigate the risk to the client's network? a. Have the employer create an acceptable use policy and implement it. b. Fire the employee c. Remove the employee's computer d. Replace the employee's computer, give them standard access, and isolate them from any network

assets ANSWER: RATIONALE:

a, d

If there is no acceptable use policy, then a curious employee could get themselves in trouble. Ha-Yoon needs to have the client make an acceptable use policy and put it into place immediately. Not all employees are bad. To make sure this doesn't happen again, Ha-Yoon should recommend that the employee be given standard access and keep him isolated from any network assets.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.4 - Describe how to manage a digital forensics investigation by taking a systematic approach TOPICS: Managing a Digital Forensics Investigation KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 17. Haris is presented with a case by a client involving employee termination. He hasn't been told about the case

yet, but he can guess. What are some of the predominate types of issues that occur in an employee termination case? Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations a. Working from home b. Creating a hostile work environment c. Playing games d. Surfing the Internet ANSWER: RATIONALE:

Haris knows that most often the usual types of employee termination cases involve abuse of company resources such as sending inappropriate emails, creating a hostile work environment, and using company resources to start a business on the side.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.5 - Describe procedures for private-sector high-tech investigations TOPICS: Procedures for Private-Sector High-Tech Investigations KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 18. Fumiko will be conducting an investigation involving Internet abuse on a client's internal private network.

What will he need to gather from his client's network administrator? a. The suspect's computer IP address b. The client's ISP IP address c. The client's router IP address d. The organization's Internet proxy server logs ANSWER: RATIONALE:

a, d

Fumiko will need to get the organization's Internet proxy server logs and the suspect's computer IP address to track where the suspect's computer has been going on the Internet.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.5 - Describe procedures for private-sector high-tech investigations TOPICS: Procedures for Private-Sector High-Tech Investigations KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 19. During an investigation, Jerry discovers that there were no matches between the network server logs and the

forensic examination showing no contributing evidence that a crime was committed. What does this mean for the investigation? a. The allegations were unsubstantiated and there was no misconduct b. The allegations were substantiated and there was misconduct Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations c. There were no allegations, just conjecture d. It was all a misunderstanding ANSWER: RATIONALE:

Because there were no matches between the logs and no contributing forensic evidence was found, Jerry was able to say that there was no misconduct on the part of the employee.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.5 - Describe procedures for private-sector high-tech investigations TOPICS: Procedures for Private-Sector High-Tech Investigations KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 20. Quan-Van is working on a case that's attorney-client privilege (ACP). The attorney asks that all

correspondence with them be verbal. What is the reason behind this request? a. The attorney doesn't like to read b. There will be too much paperwork c. Anything written down is subject to discovery d. Anything written down must be done in a very specific way ANSWER: RATIONALE:

Quan-Van has been told that once he is signed on to the case, anything written down is subject to discovery by the opposing counsel. Therefore, until the preliminary report is needed, the attorney doesn't want anything in writing.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.5 - Describe procedures for private-sector high-tech investigations TOPICS: Procedures for Private-Sector High-Tech Investigations KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 21. Olga is about to embark on her first overseas Internet abuse case. She knows the privacy laws of her state as

she has worked on Internet abuse cases on a regular basis. The client she is working for is in Germany so she can easily perform the investigation the same way in Germany as she does in the United States. a. True b. False ANSWER: RATIONALE:

Olga cannot investigate as easily in Germany as she does in the United States because

Page 11

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations

the laws covering data privacy are much stricter in the European Union than they are in the United States. Investigating a network server log without proper authorization might not be legal in Germany due to the General Data Protection Regulation (GDPR), which is the standard for data protections and privacy in the European Union (EU), and is more stringent than U.S. privacy laws POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.5 - Describe procedures for private-sector high-tech investigations TOPICS: Procedures for Private-Sector High-Tech Investigations KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 22. Dakarai has many legacy operating systems on his forensic workstation as well as the newest OSs, but he

has only the most up-to-date software on his day-to-day workstation. Why does Dakarai need legacy operating systems? a. It's not taking up much space on his forensic station, so why bother? b. It's cheaper to keep the older software around. c. Dakarai hasn't gotten around to getting rid of the old software yet. d. Older computer systems may not be compatible with modern software. ANSWER: RATIONALE:

Dakarai keeps legacy operating systems because they allow older computer systems to be analyzed while preserving the data and metadata.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.6 - Explain requirements for data recovery workstations and software TOPICS: Understanding Data Recovery Workstations and Software KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 23. Rivka is building a forensic workstation and needs to buy some hardware to get started. What are some of

the types of hardware she will need to buy? a. A workstation running Windows 7 b. A write-blocker device, spare PATA and SATA ports c. Network interface card (NIC) d. Graphics card ANSWER: RATIONALE:

b, c

Rivkas workstation must be running at least Windows 10 not 7. She will need a

Page 12

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations

write-block device, spare PATA and SATA ports and a NIC. No additional graphics capabilities beyond what is standard on modern computers will be necessary. POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.6 - Explain requirements for data recovery workstations and software TOPICS: Understanding Data Recovery Workstations and Software KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 24. Kevin is about to begin an examination of a hard drive. Out of all the tools available to him, which one is the

most important to keep the OS from writing data to the hard drive? a. SCSI card b. Network interface card (NIC) c. Write-blocker d. Target drive ANSWER: RATIONALE:

Kevin will need a write-blocker to keep the hard drive from being written to by the OS. Network interface cards, SCSI cards and target drives do not write to the hard drive.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.6 - Explain requirements for data recovery workstations and software TOPICS: Understanding Data Recovery Workstations and Software KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 25. Gerald is using MS-DOS 6.22 to examine a legacy hard drive. Why would Gerald use such an old operating

system? a. Other DOS OSs are no longer available. b. Other DOS OSs do not have the appropriate tools. c. It's the only DOS OS that works with older digital forensic tools. d. It is the only DOS OS that's least intrusive to disks. ANSWER: RATIONALE:

POINTS:

Gerald uses MS-DOS 6.22 because it is the least intrusive as far as changing data. Older DOS versions are still available and they work with older digital forensics tools, but MS-DOS 6.22 is still the best for digital forensics work.

Page 13

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.6 - Explain requirements for data recovery workstations and software TOPICS: Understanding Data Recovery Workstations and Software KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 26. Isabella is conducting an investigation for a client. She will need to copy evidence from a disk using

multiple methods. Why can't she use just one method? a. It's just for backup purposes. b. No one media type can be trusted. c. No single method retrieves all data from a disk. d. Analyzing data is a tricky job. ANSWER: RATIONALE:

Isabella must start by copying the evidence, using a variety of methods because not one tool can retrieve all data on a disk well. She needs multiple tools to analyze all the data properly.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.7 - Summarize how to conduct an investigation, including critiquing a case TOPICS: Conducting an Investigation KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 27. Sammy needs to return to the office to retrieve some antistatic bags and wrist straps before handling digital

evidence. Why are these items important for handling digital evidence? a. Static electricity doesn't do anything to digital evidence. It's just a precaution. b. Static electricity can hurt the user. c. Static electricity can make your hair stand up. d. Static electricity can destroy digital evidence. ANSWER: RATIONALE:

POINTS: QUESTION TYPE:

1 Multiple Choice

Sammy knows that static electricity can cause physical damage to digital evidence, such as computers, hard drives, and memory chips, by electrostatic discharge (ESD). That is why it is important to have antistatic bags and wrist straps. They help avoid the build up of static electricity that causes ESD.

Page 14

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.7 - Summarize how to conduct an investigation, including critiquing a case TOPICS: Conducting an Investigation KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 28. Zoey is new to the field of computer forensics. Her boss has asked her to make a bit-stream copy of a disk

drive for an investigation her company is working on. Zoey is curious why she can't make a backup copy instead. She comes to you for advice. What do you tell her? a. A bit-stream copy is used because it is an exact duplicate of the original drive. b. A backup copy has most of the files necessary; you just need to take extra steps. c. A backup copy doesn't have deleted files and emails or recovered file fragments. d. A bit-stream copy needs multiple forensic tools to get all the data off it. ANSWER: RATIONALE:

a, c

Zoey needs to create a bit-stream copy, which is a bit-by-bit copy of the original drive because it is an exact bit-by-bit replica of the original drive. Copying the drive this way gives the investigator a better chance of retrieving all the evidence needed from the copy of the original drive, since you never work on the original drive.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.7 - Summarize how to conduct an investigation, including critiquing a case TOPICS: Conducting an Investigation KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 29. Kenneth is creating a bit-stream image from a bit-stream copy of an evidence drive, but he's confused as to

what the difference is. To Kenneth, there isn't much difference. Please help him out and tell him what makes a bit-stream image different from a bit-stream copy. a. A bit-stream image and a bit-copy are identical. b. A bit-stream image replicates the evidence drive but is not an exact copy. c. There only has to be one bit-stream copy made when working on an image drive. d. A bit-stream image creates an exact copy of the evidence disk down to the physical drive level. ANSWER: RATIONALE:

Kenneth is creating a bit-stream image. The difference between a bit stream-image and a bit-stream copy is that the image is an exact copy of the data down to the physical (target drive) being the same make and model of the evidence drive. Whereas the bit-copy is just a copy of the evidence drive but not on the same make

Page 15

Name:

Class:

Date:

Mod 01: Understanding the Digital Forensics Profession and Investigations

and model of the actual drive (target drive). POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.7 - Summarize how to conduct an investigation, including critiquing a case TOPICS: Conducting an Investigation KEYWORDS: Bloom's: Apply DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM 30. Stella just finished writing a report for Tera Corp. and reviews her report one more time to check the steps

she took to be sure her findings are repeatable. The problem is she used a new tool in her findings that has not been vetted by industry experts yet, so it may not adhere to industry standards. Why is this an issue? a. New tools that are not vetted may not return repeatable data. b. It doesn't change anything. c. New tools are used all the time. d. It's not important to repeat results. ANSWER: RATIONALE:

Stella used a new tool that hasn't been vetted by industry experts and therefore may not adhere to industry standards. This issue will bring Stella's conclusions into question and may cause opposing counsel to try and throw out the case.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.1.7 - Summarize how to conduct an investigation, including critiquing a case TOPICS: Conducting an Investigation KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/18/2024 2:41 PM DATE MODIFIED: 4/18/2024 2:41 PM

Page 16

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations 1. Daubert v. Merrell Dow Pharmaceuticals rules that the "testimony must be based off facts or data, whereas

using Frye v. United States rules, the "testimony" must be based on generally accepted principles in the field in which it belongs. a. True b. False ANSWER: RATIONALE:

Daubert v. Merrell Dow Pharmaceuticals rules that the "testimony must be based off facts or data, whereas using Frye v. United States rules, the "testimony" must be based on generally accepted principles in the field in which it belongs.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.1 - Explain the importance of reports and testimony and preparing to testify TOPICS: Understanding the Importance of Reports with a View to Testifying KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 2. Each state has its own rules of civil procedure, which may be less stringent than federal rules but can never be

more so. a. True b. False ANSWER: RATIONALE:

Each state has its own rules of civil procedure, which may be MORE stringent than the federal rules but can never be LESS so.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.1 - Explain the importance of reports and testimony and preparing to testify TOPICS: Understanding the Importance of Reports with a View to Testifying KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 3. Feng Mian is going to be a lay witness in Zepher Inc. v. United States. This will be the first time Feng Mian

testifies. What is the purpose of a lay witness's testimony? a. Testifies to evidence in the case b. Testifies to personally observed facts c. Testifies to evidence for a search warrant Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations d. Testifies to an accounting report ANSWER: RATIONALE:

Since Feng Mian is a lay witness, she will testify with first-hand knowledge of an event she witnessed that is relevant to the case.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.1 - Explain the importance of reports and testimony and preparing to testify TOPICS: Understanding the Importance of Reports with a View to Testifying KEYWORDS: Bloom's: Apply DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 4. Maddox is an expert in exfiltration (removal) of data. He is testifying about an incident where Areon Corp.

lost its customer database to hackers over several months. He has no personal knowledge of the incident but has been called to testify before a jury. In what manner is Maddox allowed to testify? a. He may testify as if he has personal knowledge of the event. b. He can state his opinions by responding to actual questions. c. He must state opinions by responding to hypothetical questions. d. He should testify only about what he knows. ANSWER: RATIONALE:

Maddox doesn't have personal knowledge about the specific occurrence (data exfiltration), so he must state his opinion by responding to hypothetical questions from the attorney that are based on available factual evidence.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 5. Emilia is in the process of writing a preliminary report for the first time. Her friend Amari tells her to be

careful as to what to write because a preliminary report is a high-risk document. What makes a preliminary report a high-risk document? a. It's a final report. b. Opposing counsel can try and discredit you with it. c. The preliminary report can always be used against you in a court of law. d. Opposing counsel can demand discovery on it. Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations ANSWER: RATIONALE:

b, d

The preliminary report is considered a high-risk document because, if written, opposing counsel may demand discovery on it and may also use it to try and discredit Emilia.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 6. Xiang Liu is writing her report. Her mentor Steve Lu reminds Xiang that "objectivity is critical when writing

a report." This is a very important statement. Why do you think Steve reminded her about objectivity? a. She must be biased in her writing. b. She must communicate calm, detached observations in her report. c. It's better to identify flaws rather than to allow opposing counsel to do it for her. d. She should use passive voice in her writing. ANSWER: RATIONALE:

b, c

Steve wants Xiang to know that "objectivity is critical" because she is not trying to solve the case. Therefore, she must be unbiased and detached as she is just presenting the facts of the case to the judge, jury, and counsel. Only the jury can decide on guilt or innocence.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Apply DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 7. Caleb created a hash value on a file he was working on before he left for the day. When he came back the

next day, the hash value had changed. Since there was a change in hash value, what did that do to the file Caleb was working on? a. The file had been opened. b. The file had been altered. c. The file had been erased. d. The file had been moved. ANSWER:

Page 3

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations RATIONALE:

Caleb's file had been altered in some way. Any alteration in a file will cause the hash value to change.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Apply DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 8. Avraham knows that for a statement to be considered absolutely true, it must be stated conservatively.

However, it might be considered a guess if he overreaches. How can Avraham protect his credibility? a. By making a statement of limitations of knowledge and uncertainty b. Swearing on a Bible c. Reading off his CV to the jury d. Talking about past cases ANSWER: RATIONALE:

Avraham knows that for a statement to be considered absolutely true, it must be stated conservatively. However, it might be considered a guess if he overreaches. He can find greater truth by throwing a wider net and collecting more evidence to support his statement. The narrower the net, or less evidence, the more the evidence becomes a guess.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Apply DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 9. Jennifer is working at a research lab and is about to write her first report. As she sits down to write, she

begins by making a template. Her colleague Mike stops by and tells her that's a bad idea. Why would Mike argue against Jennifer using her own template? a. Organizations are picky about who writes report templates. b. Organizations likely have established templates for reports. c. Organizations want people to ask for permission before creating templates. d. Organizations want reports written quickly. ANSWER: RATIONALE:

Jennifer should not create her own template because the organization she works for

Page 4

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations

likely has its own template(s) they use for report writing. POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 10. Helga is writing her report. It's going to be long and complex, so she needs to create an abstract. She puts the

abstract at the beginning of the report. What is the reason Helga puts the abstract at the beginning of the report? a. More people read the abstract than the entire report. b. The abstract summarizes the report. c. The abstract names the guilty party. d. The abstract is the conclusion of the case. ANSWER: RATIONALE:

a, b

Helga puts the abstract at the beginning of the report because more people read the abstract since it's a summary of the report itself.

POINTS: 1 QUESTION TYPE: Multiple Response HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.2 - Describe guidelines for writing reports TOPICS: Guidelines for Writing Reports KEYWORDS: Bloom's: Analyze/Create/Evaluate DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 11. Aziz is about to write his report and grabs his examiner's notes to begin. His new assistant Asif, who is new

to the field of computer forensics, wants to know what's so special about the book. Aziz tells Asif it's to keep track of all his notes during an examination. What are some of the notes Aziz is referring to? a. Documenting the exam process b. Providing a path for repeatability c. Taking notes for the attorney d. Analyzing notes for the suspect ANSWER: RATIONALE:

a, b

POINTS: QUESTION TYPE:

1 Multiple Response

Aziz is referring to keeping track of the findings and recording all steps taken during the examination. These notes will also provide the path for repeatability of his findings.

Page 5

Name:

Class:

Date:

Mod 02: Report Writing and Testimony for Digital Investigations HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.3 - Describe procedures for generating report findings and writing a digital forensics report TOPICS: Generating Report Findings and Writing the Digital Forensics Report KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 12. Miriam's PDF is about to be put into the e-discovery database. The document has several images in it. When

she puts it through the OCR (Optical Character Recognition) software, the text for the images comes out garbled. So before Miriam adds her document to the e-discovery database, what steps should she take to correct the errors she finds? a. Run it through the OCR software again and then send it. b. Leave it as a PDF. c. Give it to someone else to fix. d. Check the OCR document and be sure to correct any errors she finds. ANSWER: RATIONALE:

Miriam should fix any issues she finds after running the OCR software before sending the document. That way, there can be no misinterpretation causing an embarrassing situation.

POINTS: 1 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: Ceng.GuideForens.25.2.3 - Describe procedures for generating report findings and writing a digital forensics report TOPICS: Generating Report Findings and Writing the Digital Forensics Report KEYWORDS: Bloom's: Remember/Understand DATE CREATED: 4/19/2024 2:08 PM DATE MODIFIED: 4/19/2024 2:08 PM 13. Camilla works for an attorney so she must bill her time by the hour. Time duration is listed in tenths of an

hour. How many minutes are there in a 10th of an hour? a. 10 minutes b. 12 minutes c. 6 minutes d. 5 minutes ANSWER: RATIONALE:

POINTS: QUESTION TYPE: HAS VARIABLES:

1 Multiple Choice False

Camilla must bill in six-minute increments, which is a tenth of an hour.

Page 6