Deck 2: Computer Forensics Anddigital Detective Work

Question 1

________ is created when a file is created if it does not take up an entire sector.

Answer 1

File slack

Question 2

In the case in which a hacker named Maxim broke into CD Universe credit card files,the FBI and company employees accessed original files to determine how the intrusion had occurred.What was the impact on the case of working with original files?

A)There was no impact on the case,because a correct chain of custody form was produced.
B)The case was nullified,because the last-access dates on the original files were changed.
C)There was no impact on the case,because the original files were copied correctly.
D)The case was nullified,because the FBI did not have permission to open the original files.

Answer 2

B

Question 3

What type of program is available to delete and overwrite data on a computer?

A)File-overwriting software
B)File-deleting software
C)File-wiping software
D)All of the above

Answer 3

C

Question 4

In 2005,the estimated number of e-mail users in the United States was

A)105 million
B)105 billion
C)1.5 million
D)1.5 billion

Question 5

Which of the following is NOT considered one of the five stages of a computer investigation?

A)Intelligence
B)Hypothesis
C)Conviction
D)Conclusion

Question 6

Which of the following is NOT considered an objective in ensuring probative information is recovered?

A)To protect the computer system during the actual investigation
B)To search for any and all malware that may have infected the system
C)To recover deleted,existing,hidden,and password protected files
D)To determine if steganography was used

Question 7

What unique piece of evidence finally gave police the break they'd needed in order to solve the BTK serial murderer case?

A)A phone number located within a computer
B)A USB drive with his deleted address
C)A floppy disk with his deleted address
D)A floppy disk with a deleted address of a church

Question 8

The chain of custody must include which of the following items?

A)Where the evidence was stored
B)The size of the containers used to store the evidence
C)How heavy the evidence was when acquired
D)The relevance of the evidence

Question 9

Hackers go after valuable content such as

A)Expensive applications
B)Links to terrorist Web sites
C)Pricing data
D)Malware scripts

Question 10

Criminal trials are often preceded by a(n)________ at which the admissibility of evidence is determined.

Question 11

________ is a term generally used to indicate a message is hidden within another file.

Question 12

The ________ is documentation that the evidence was handled and preserved properly.

Question 13

Evidence may be suppressed if which of the following occurs?

A)If the officer exceeds the limited right or scope
B)If the police do not have a warrant
C)If the officer takes more than is on the warrant
D)All of the above

Question 14

Robert Hanssen stored documents he was stealing from the FBI and selling to the Russians on a(n)

A)MP3 player
B)Palm III PDA
C)Laptop computer
D)Cell phone

Question 15

The emphasis on computer forensics as a(n)________ is important because it recognizes the field as a discipline with set principles.

Question 16

Which of the following traditional crimes are easier because of widespread computer access?

A)Breaking and entering
B)Money laundering
C)Armed robbery
D)Assault

Question 17

Evidence collected in violation of which amendment will cause the evidence to be excluded?

A)The Fourth Amendment
B)The First Amendment
C)The Ninth Amendment
D)The Tenth Amendment

Question 18

In what manner were e-commerce employees caught making online purchases using clients' credit card numbers?

A)Copies of credit card numbers were found in their desks.
B)Copies of transactions were found at their homes.
C)Saved files were stored in a hidden directory.
D)Credit card numbers,along with the name and address of person who placed order,were found in a hidden HTML coded file.

Question 19

In order to be legally defensible,methods used in the recovery of data must ensure that

A)The original evidence was not altered.
B)No data was added to the original.
C)No data was deleted from the original.
D)All of the above

Question 20

Which of the following is NOT considered one of the items e-evidence is currently being used for?

A)To prove intent
B)To imply motive
C)To provide alibis
D)All listed are currently being used

Question 21

The ________ states that evidence collected in violation of the Fourth Amendment cannot be used in a trial.

Question 22

Care,control,and chain of custody are called the ________ of evidence.

Question 23

A(n)________ is a reasonable belief that a person has committed a crime.

Question 24

One of the more popular theories is that a person could actually commit ________ by changing a patient's medication data.

Question 25

If evidence items are released to auditors or authorities,the ________ should be recorded.

Question 26

According to a 2003 survey,________ and China had the highest piracy rates.

Question 27

________ is the blending of accounting,auditing,and investigative skills.

Question 28

Criminals whose purpose is ________ need to brag about their exploits because they are motivated by a desire for fame or notoriety.