Question 1

There are various ways to prepare sterile media, but a common method is to write ____ to every block on the device to erase any previous contents and then, if needed, format the device with a file system.
A) blank spaces
B) zeros
C) ones
D) bit-streams

Accepted Answer

Writing zeros to every block on the device is a common method used to erase any previous contents, ensuring the media is sterile or clean from any previous data. This process is often referred to as zero-filling or zeroing out a drive.

Question 2

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Must be disclosed

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 3

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Does extensive preprocessing of the evidence items and organizes the various items into a tabbed display

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 4

____________________ is collecting evidence from a currently running system.

Accepted Answer

The answer of ____________________ is collecting evidence from a currently...

Question 5

In principle, the ____________________ is quite simple; basically, it is a legal record of where the evidence was at each point in its lifetime as well as documentation of each and every access there was to it.

Accepted Answer

The answer of In principle, the ____________________ is quite simple;...

Question 6

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Recovering files, images, and so forth from fragments in free space

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 7

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Presents an extensible forensic platform that makes it easy for trained investigators to carry out their tasks

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 8

Which audience is interested in analysis report issues in terms of compliance with organizational policies?
A) Upper management
B) Forensic experts
C) Attorneys
D) Auditors

Accepted Answer

Auditors are responsible for ensuring that an organization's operations comply with established policies and regulations, making them the audience interested in analysis report issues related to compliance.

Question 9

A disadvantage of hardware imaging platforms is that they are ____.
A) fragmented
B) time consuming
C) costly
D) unreliable

Accepted Answer

Hardware imaging platforms can be costly due to the need for specialized equipment and software, which can represent a significant investment for organizations.

Question 10

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-An enclosure that ensures that electromagnetic waves are blocked so that a device cannot transmit or receive radio waves while in custody

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 11

One way to identify a particular digital item (which is represented as a collection of bits) is by means of a cryptographic ____________________.

Accepted Answer

The answer of One way to identify a particular digital...

Question 12

____ forensics involves capturing a point-in-time picture of a process.
A) Bit-stream
B) Cartwheeling
C) Snapshot
D) Trigger

Accepted Answer

Snapshot forensics involves capturing a point-in-time picture of a process, allowing for the examination of a system's state at a specific moment.

Question 13

Computer ____________________ is defined as the use of technical investigation and analysis techniques to identify, collect, preserve, and analyze electronic items of potential evidentiary value so that they may be admitted as evidence in a court of law, used to support administrative action, or simply used to further analyze suspicious data.

Accepted Answer

The answer of Computer ____________________ is defined as the use...

Question 14

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Device that allow you to acquire the information on a drive without accidentally damaging the drive's contents

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 15

____________________ forensics applies to all modern electronic devices, including mobile phones, personal digital assistants (PDAs), portable music players, and other electronic devices capable of storing digital information.

Accepted Answer

The answer of ____________________ forensics applies to all modern electronic...

Question 16

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-A technique in which a term is extended via links to subsidiary terms

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 17

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Has a set of all the portable equipment and tools needed for an investigation

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 18

Which audience is typically interested in the analysis report recommendations as to whether or not the allegations were correct?
A) Upper management
B) Forensic experts
C) Attorneys
D) Auditors

Accepted Answer

Upper management is typically interested in the analysis report recommendations to make informed decisions based on whether the allegations were correct.

Question 19

Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump bag
h.EnCase Forensic
d.Desiccants
i.Write blocker
e.Faraday Cage
-Drying agents to absorb any moisture

Accepted Answer

The answer of Match each item with a statement below.
a.Discoverable
f.Carving
b.Cartwheeling
g.FTK
c.Jump...

Question 20

Forensic investigators use ____ (also known as sector-by-sector) copying when making a forensic image of a device.
A) sector-stream
B) sector
C) byte-stream
D) bit-stream

Accepted Answer

Forensic investigators use bit-stream copying, also known as sector-by-sector copying, when making a forensic image of a device to ensure an exact replica of the storage medium is created, capturing all data including deleted files and slack space.

Quiz 12: Digital Forensics

There are various ways to prepare sterile media, but a common method is to write ____ to every block on the device to erase any previous contents and then, if needed, format the device with a file system.

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Must be disclosed

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Does extensive preprocessing of the evidence items and organizes the various items into a tabbed display

____________________ is collecting evidence from a currently running system.

In principle, the ____________________ is quite simple; basically, it is a legal record of where the evidence was at each point in its lifetime as well as documentation of each and every access there was to it.

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Recovering files, images, and so forth from fragments in free space

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Presents an extensible forensic platform that makes it easy for trained investigators to carry out their tasks

Which audience is interested in analysis report issues in terms of compliance with organizational policies?

A disadvantage of hardware imaging platforms is that they are ____.

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -An enclosure that ensures that electromagnetic waves are blocked so that a device cannot transmit or receive radio waves while in custody

One way to identify a particular digital item (which is represented as a collection of bits) is by means of a cryptographic ____________________.

____ forensics involves capturing a point-in-time picture of a process.

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Device that allow you to acquire the information on a drive without accidentally damaging the drive's contents

____________________ forensics applies to all modern electronic devices, including mobile phones, personal digital assistants (PDAs), portable music players, and other electronic devices capable of storing digital information.

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -A technique in which a term is extended via links to subsidiary terms

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Has a set of all the portable equipment and tools needed for an investigation

Which audience is typically interested in the analysis report recommendations as to whether or not the allegations were correct?

Match each item with a statement below. a.Discoverable f.Carving b.Cartwheeling g.FTK c.Jump bag h.EnCase Forensic d.Desiccants i.Write blocker e.Faraday Cage -Drying agents to absorb any moisture

Forensic investigators use ____ (also known as sector-by-sector) copying when making a forensic image of a device.