Question 1

The term RCFL stands for the following:&#10;A) Restrictive computerized field of light&#10;B) Regional computer forensic laboratories&#10;C) Regional computational form laboratories&#10;D) Remote computer field laboratories

Accepted Answer

RCFL stands for Regional Computer Forensic Laboratories, which are established by the Federal Bureau of Investigation (FBI) to provide digital and computer forensic services to law enforcement agencies in specific regions of the United States.

Question 2

Which of the following crimes are likely to involve digital devices?&#10;A) Child pornography&#10;B) Identity theft&#10;C) Terrorism&#10;D) All of the above

Accepted Answer

All three crimes - child pornography, identity theft, and terrorism - are likely to involve digital devices.

Child pornography often involves the distribution and/or possession of images and videos that are stored and shared digitally.

Identity theft can be carried out using various digital techniques, such as phishing, malware attacks, and hacking, to access personal and financial information.

Terrorism can include the use of digital devices and communication technologies to plan and coordinate attacks or spread propaganda.

Question 3

The FBI defines digital forensics as the application of science and engineering to the recovery of digital evidence in a legally acceptable method

Accepted Answer

The FBI does indeed define digital forensics as the application of science and engineering to the recovery of digital evidence in a legally acceptable method.

Question 4

Due to the unique nature of digital evidence a search warrant is not needed to secure this type of evidence

Accepted Answer

A search warrant is generally required to seize any type of evidence, including digital evidence. However, there are certain circumstances in which digital evidence may be obtained without a warrant, such as with the owner's consent or in certain emergency situations.

Question 5

Which of the following is the most appropriate way to collect computer evidence?&#10;A) Use common software at the scene to start up the computer and copy it to a removable drive for later analysis&#10;B) Allow an employee or homeowner to start of the computer and copy it to a removable drive for later analysis&#10;C) Unplug the computer (that is not on a network), label all cables and transport to the lab for analysis&#10;D) Reboot the computer prior to shutting down to save the data. Label all cords an accessories and package the computer for delivery to the lab for analysis

Accepted Answer

Unplugging the computer and transporting it to a secure lab for analysis is the most appropriate way to ensure the preservation of evidence and prevent any alteration or deletion of data. Labeling all cables and accessories ensures that the equipment can be correctly reassembled for analysis. Starting up or rebooting the computer could alter or delete data, and allowing an employee or homeowner to handle the computer could compromise the evidence chain of custody.

Question 6

You must be trained to an expert level for digital evidence to seize computer evidenced for subsequent analysis

Accepted Answer

While it is preferred that digital evidence be seized by trained professionals, it is not required that they be experts. However, it is important for those seizing digital evidence to have a basic understanding of digital forensics and proper evidence handling procedures to ensure the integrity of the evidence.

Question 7

In certain circumstances, it may be necessary to do an on-scene evidence preview to help determine what specific devices to look for. A preview of a suspect's hard drive can show whether an external device like a USB thumb drive was connected and when. Who should perform this type of investigation in the field?

A) Crime scene investigator
B) First responder
C) Supervisor
D) Any investigator properly trained

Accepted Answer

Any investigator properly trained should perform this type of investigation in the field. It is important that the investigator has the necessary skills and knowledge to safely preview evidence on-scene. This can include digital forensics specialists or investigators trained in computer and digital device analysis.

Question 8

One of the first questions asked by investigators responding to the crime scene should be________.&#10;A) Is there a video of the incident?&#10;B) Where are the surveillance cameras?&#10;C) Where are the video recorders stored?&#10;D) All of the above

Accepted Answer

All of the options are pertinent questions for investigators to ask upon arriving at a crime scene, as they all relate to obtaining video evidence which can be crucial for the investigation.

Question 9

When handling video evidence, you should note the _________ on the recorder and simultaneously note the ________ on a watch or clock&#10;A) Counter, time&#10;B) Time, time&#10;C) Counter, hands&#10;D) Time, counter

Accepted Answer

The answer of When handling video evidence, you should note...

Question 10

You are the investigator of a homicide that took place in a strip mall near an apartment complex. Which of the following would you choose as a source of video footage to check to see if the crime was captured?

A) ATM videos
B) Video doorbells
C) Convenience store cameras
D) All of the above

Accepted Answer

The best choice would be all of the above, as ATM videos, video doorbells, and convenience store cameras all have the potential to capture footage of the strip mall and the surrounding area. Checking all of these sources increases the likelihood of finding footage that could provide evidence for the homicide investigation.

Question 11

Why would an investigator document the video system's physical relationship to the crime scene?&#10;A) Known reference object size can be used to determine physical dimensions of other things in the video such as the height of a suspect&#10;B) It can be used to validate the authenticity of the video&#10;C) It is part of the routine of sketching the scene&#10;D) None of the above

Accepted Answer

The answer of Why would an investigator document the video...

Question 12

What is the benefit expected from the analysis of video recordings?&#10;A) They can show the crime scene&#10;B) They can provide a synopsis of a crime and/or a description of a crime scene that would be hard to describe in words alone&#10;C) It provides images of action&#10;D) All of the above

Accepted Answer

The answer of What is the benefit expected from the...

Question 13

What is the benefit of a fingerprint analyst at the scene reviewing video footage from the crime scene event?&#10;A) They can see where the suspect was walking&#10;B) They can focus on areas the suspect touched&#10;C) They can evaluate the skin detail on the suspects hands&#10;D) There is no benefit for them reviewing the video

Accepted Answer

The answer of What is the benefit of a fingerprint...

Question 14

______________, is the discipline of image-based comparison of human facial features.&#10;A) Facial recognition&#10;B) Facial Identification&#10;C) Forensic Artist&#10;D) Facial line-up

Accepted Answer

The answer of ______________, is the discipline of image-based comparison...

Question 15

This device is used to block radio frequencies from reaching the mobile device and prevents usable wireless signals from going in or coming out.&#10;A) Evidence bag/box&#10;B) Filmore bag/box&#10;C) Faraday bag/box&#10;D) Plastic bag/box

Accepted Answer

The answer of This device is used to block radio...

Deck 19: Digital Evidence and the Electronic Crime Scene