Deck 3: The Investigators Office and Laboratory

Question 1

Windows hard disks can now use a variety of file systems, including FAT16, FAT32, ____, and Windows File System.

A) NTFS
B) ext3
C) FAT24
D) ext2

Answer 1

A

Question 2

A good working practice is to use less powerful workstations for mundane tasks and multipurpose workstations for the higher-end analysis tasks.

Answer 2

True

Question 3

Defense contractors during the Cold War were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. The U.S. Department of Defense calls this special computer-emission shielding ____.

A) TEMPEST
B) RAID
C) NISPOM
D) EMR

Answer 3

A

Question 4

If damage occurs to the floor, walls, ceilings, or furniture on your computer forensics lab, it does not need to be repaired immediately.

Question 5

Computing systems in a forensics lab should be able to process typical cases in a timely manner.

Question 6

IACIS requires recertification every ____ years to demonstrate continuing work in the field of computer forensics.

A) 2
B) 3
C) 4
D) 5

Question 7

Requirements for taking the EnCE certification exam depend on taking the Guidance Software EnCase training courses.

Question 8

A secure storage container or cabinet should be made of ____ and include an internal cabinet lock or external padlock.

A) gypsum
B) steel
C) wood
D) expanded metal

Question 9

You should have at least one copy of your backups on site and a duplicate copy or a previous copy of your backups stored in a safe ____ facility.

A) in-site
B) storage
C) off-site
D) online

Question 10

____ was created by police officers who wanted to formalize credentials in computing investigations.

A) HTCN
B) NISPOM
C) TEMPEST
D) IACIS

Question 11

The EMR from a computer monitor can be picked up as far away as ____ mile.

A) 1/4
B) 1/2
C) 3/4
D) 1

Question 12

Lab costs can be broken down into daily, ____, and annual expenses.

A) weekly
B) monthly
C) bimonthly
D) quarterly

Question 13

One way to investigate older and unusual computing systems is to keep track of ____ that still use these systems.

A) AICIS lists
B) uniform reports
C) SIGs
D) Minix

Question 14

A ____ is where you conduct your investigations, store evidence, and do most of your work.

A) forensic workstation
B) computer forensics lab
C) storage room
D) workbench

Question 15

To preserve the integrity of evidence data, your lab should function as an evidence locker or safe, making it a ____ or a secure storage safe.

A) secure workstation
B) secure workbench
C) protected PC
D) secure facility

Question 16

____ are generated at the federal, state, and local levels to show the types and frequency of crimes committed.

A) HTCN reports
B) IDE reports
C) Uniform crime reports
D) ASCLD reports

Question 17

A ____ plan also specifies how to rebuild a forensic workstation after it has been severely contaminated by a virus from a drive you're analyzing.

A) disaster recovery
B) risk management
C) configuration management
D) security

Question 18

Performing a forensic analysis of a disk 200 GB or larger can take several days and often involves running imaging software overnight and on weekends.

Question 19

Floors and carpets on your computer forensic lab should be cleaned at least ____ a week to help minimize dust that can cause static electricity.

A) once
B) twice
C) three times
D) four times

Question 20

What HTCN certification level requires candidates have three years of investigative experience in any discipline from law enforcement or corporate or have a college degree with one year of experience in investigations?

A) Certified Computer Crime Investigator, Basic Level
B) Certified Computer Crime Investigator, Advanced Level
C) Certified Computer Forensic Technician, Basic
D) Certified Computer Forensic Technician, Advanced

Question 21

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
tool for directly restoring files

Question 22

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
certification program that regulates how crime labs are organized and managed

Question 23

The ______________________________ provides guidelines for managing a forensics lab and for acquiring official crime-lab certification.

Question 24

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
stands for Metropolitan Area Network

Question 25

In the ____, you justify acquiring newer and better resources to investigate computer forensics cases.

A) risk evaluation
B) business case
C) configuration plan
D) upgrade policy

Question 26

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
a plan you can use to sell your services to your management or clients

Question 27

For daily work production, several examiners can work together in a large open area, as long as they all have ____________________ level of authority and access need.

Question 28

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
a high-end RAID server from Digital Intelligence

Question 29

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
sponsors the EnCE certification program

Question 30

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
ruled by the IEEE 1394B standard

Question 31

In addition to performing routine backups, record all the updates you make to your workstation by using a process called ____ when planning for disaster recovery.

A) configuration management
B) risk assessment
C) recovery logging
D) change management

Question 32

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
addresses how to restore a workstation you reconfigured for a specific investigation

Question 33

____________________ Chapter 5, Section 3 (http://nsi.org/Library/Govt/Nispom.html) describes the characteristics of a safe storage container.

Question 34

For labs using high-end ____ servers (such as Digital Intelligence F.R.E.D.C. or F.R.E.D.M.), you must consider methods for restoring large data sets.

A) RAID
B) ISDN
C) WAN
D) TEMPEST

Question 35

The lab ____________________ sets up processes for managing cases and reviews them regularly.

Question 36

Computing components are designed to last 18 to ____ months in normal business operations.

A) 24
B) 30
C) 36
D) 42

Question 37

Match each item with a statement below
a.FireWire
f.SIG
b.Guidance Software
g.MAN
c.Business case
h.Norton Ghost
d.F.R.E.D.C.i.Disaster recovery plan
e.ASCLD/LAB
can be a valuable source of support for recovering and analyzing uncommon systems

Question 38

A(n) ____________________ plan ensures that you can restore your workstations and file servers to their original condition if a catastrophic failure occurs.

Question 39

By using ____ to attract new customers or clients, you can justify future budgets for the lab's operation and staff.

A) pricing
B) marketing
C) budgeting
D) changing

Question 40

____ involves determining how much risk is acceptable for any process or operation, such as replacing equipment.

A) Risk configuration
B) Change management
C) Configuration management
D) Risk management

Question 41

Illustrate a proper way of disposing materials on your computer investigation lab.

Question 42

Discuss the use of a laptop PC as a forensic workstation.

Question 43

What are the minimum requirements for a computer investigation and forensics lab?

Question 44

Briefly outline the process of selecting workstations for a police computer investigation lab.

Question 45

Provide a brief explanation of how to plan a lab budget.

Question 46

What are the questions you need to ask when planning the justification step of a business case?

Question 47

What are the four levels of certification offered by HTCN?

Question 48

What are the duties of a lab manager?

Question 49

Give a brief explanation of a computer forensics lab auditing process.

Question 50

What peripheral devices should be stocked in your computer forensics lab?