Deck 23: Digital Evidence on the Internet

Question 1

Who is authorized to conduct online undercover investigations when child pornography is involved?

A) Anyone
B) Computer security professionals
C) Journalists
D) Law enforcement

Answer 1

D

Question 2

When you access a web page, the content may be located on a server other than the one you accessed.

Answer 2

True

Question 3

What peer-to-peer clients use the Fast Track network?

A) KaZaA
B) Grokster
C) iMesh
D) All of the above

Answer 3

D

Question 4

Web Whacker and Httrack are examples of tools that:

A) Search the Web
B) Deface websites
C) Capture websites
D) Launch websites

Question 5

Second Life is one of the better known:

A) Research websites
B) Archive websites
C) Virtual worlds
D) Web-based game shows

Question 6

Synchronous chat networks are particularly conducive to criminal activity because of their

A) Privacy
B) Immediacy
C) Impermanence
D) All of the above

Question 7

Metaverseink is a:

A) Search tool (people or things) for virtual worlds
B) Newsgroup aggregator
C) Social networking meta-tool
D) A file-sharing peer-to-peer network

Question 8

When it is not possible to determine the identity of the author of a Usenet message using IP addresses in the header, what else can you do to learn more about the author?

A) Look for unusual signature and use of language
B) Search the Web using distinctive aspects of posts
C) Look for similar Usenet messages posted using an alias
D) All of the above

Question 9

What are two of the most useful headers for determining the origination of Usenet messages?

A) From and Message-ID
B) NNTP-Posting-Host and X-Trace
C) Path and Subject
D) RFC1036 and RFC2980

Question 10

What characteristics of IRC make it attractive to criminals?

A) IRC enables them to exchange illegal materials with other criminals.
B) IRC provides them with some level of anonymity.
C) IRC gives them direct, "live" access to a large pool of potential victims.
D) All of the above.

Question 11

Which of the following enables a user to connect to IRC and run IRC fserves without disclosing their IP address?

A) Freenet
B) psybnc bot
C) Fserve
D) All of the above

Question 12

The cybertrail is only useful for gathering information about an offender, not a victim.

Question 13

Why is it important to hide your identity when conducting an online investigation?

A) To reduce the risk of alerting the offender
B) To get yourself in the mindset of covert web investigating
C) To make it easier for you to determine the offender's location
D) All of the above

Question 14

Which of the following tools can reconstruct TCP streams?

A) Tcpdump
B) Wireshark
C) Snoop
D) EnCase

Question 15

What information should you document when searching for evidence on the Web?

A) Date/time of search, search engine and terms used, address of pertinent results
B) Screenshots of significant search results
C) Download copies of the webpages and calculate their MD5 value
D) All of the above

Question 16

Whois databases contain contact information relating to IP addresses but not domain names.

Question 17

Which of the following applications leave traces of Internet activities on a personal computer?

A) Internet Explorer
B) KaZaA
C) IRC
D) All of the above

Question 18

All web search engines use the same search syntax.

Question 19

The "invisible Web" can only be accessed by government employees.

Question 20

Which of the following Internet services can be used to exchange illegal materials?

A) IRC
B) Usenet
C) KaZaa
D) All of the above

Question 21

Criminals let their guard down in chat networks because they feel protected by the perceived anonymity.

Question 22

Posting information online takes control of the information away from the person and such information can remain online indefinitely.

Question 23

The Web archive (web.archive.org) contains a complete and accurate copy of web pages as they existed at a particular time.

Question 24

When evidence is located on the Internet, investigators should document and preserve it immediately or it may be gone the next time they look for it.

Question 25

It is not possible to decrypt and view captured network traffic.

Question 26

Pseudonymous e-mail enables the sender to receive responses to messages whereas anonymous e- mail does not.

Question 27

Freenet is not being widely used by criminals to exchange illegal materials because it is too difficult to use.

Question 28

E-mail Received headers can be relied on for tracking purposes because they cannot be forged.

Question 29

Given the wealth of information that social networks contain, digital investigators will often find useful information at these sites.

Question 30

KaZaa has one feature that can be beneficial from an investigative standpoint - whenever possible, it obtains files from peers in the same geographical region.