Question 1

Under the Daubert test, in order for a technique or theory to be called scientific, the technique or theory should have been published in peer-reviewed scientific journals.
Data that is only logically deleted is protected and can be un-deleted any time before the user chooses the option to physically delete it.

Accepted Answer

Data that is logically deleted can be un-deleted until it is physically deleted, hence it is protected.

Question 2

What is the wipe standard for the Department of Defense?

Accepted Answer

The wipe standard for the Department of Defense states that media must be written over 7 times before it is considered erased. This is known as the 7-pass wipe method.

Answer: B 
 The Department of Defense does not specify a specific power for a magnet to wipe out a hard drive's contents. The idea that a 7X power magnet is required is a myth.

Answer: C 
 The Department of Defense does not require a surface wipe with an ionic scope prior to opening and removing components. This is not a standard practice for data wiping.

Answer: D 
 Data stored in a computer's RAM is not a part of the wipe standard for the Department of Defense. The wipe standard pertains to data stored on media such as hard drives and tapes.

Question 3

Which of the following systems deals specifically with fingerprints?

Accepted Answer

IAFIS (Integrated Automated Fingerprint Identification System) deals specifically with fingerprints. NDIS (National DNA Index System) deals with DNA profiles, CODIS (Combined DNA Index System) deals with the collection and analysis of DNA evidence, and NIBIN (National Integrated Ballistic Information Network) deals with ballistics evidence.

Question 4

A CART team consists of accountants who have the computer and accounting knowledge to determine criminal activities.

Accepted Answer

A CART (Computer Analysis and Response Team) team typically consists of computer forensic experts, not accountants, who analyze digital evidence to investigate criminal activities.

Question 5

All courts treat all scientific data the same.

Accepted Answer

All courts do not treat all scientific data the same. Different courts and jurisdictions have different standards for evaluating scientific evidence and determining its admissibility in court. Some courts may rely heavily on scientific evidence, while others may be more skeptical or require a higher standard of proof. Additionally, the weight given to scientific evidence may vary depending on the facts of the case and the particular legal issues involved.

Question 6

Forensic science can be described as:

Accepted Answer

Forensic science encompasses the application of various scientific disciplines to legal matters, such as analyzing physical evidence left at a crime scene. It is not limited to technology or accounting, but rather a broad field that applies science to legal investigations.

Question 7

The objective of indirect methods is not to identify specific transactions that could represent underpayments of tax although in some cases these methods lead to specific items.

Accepted Answer

The objective of indirect methods is to detect patterns or discrepancies that may indicate potential underpayments of tax, rather than to identify specific transactions. However, in some cases, these methods may lead to specific items that require further investigation.

Question 8

Forensic Accountants are crime-scene technicians or investigators who specialize in finding, collecting, and preserving physical evidence at crime scenes.

Accepted Answer

Forensic Accountants specialize in investigating financial crimes by analyzing and interpreting financial data and records. They do not typically collect physical evidence at crime scenes.

Question 9

How many keyboard strokes are typically stored in the RAM?

Accepted Answer

RAM typically stores data in blocks or pages, and 1024 is a common size for such blocks, making it a plausible choice for the number of keyboard strokes stored.

Question 10

What type of information should a forensic accountant keep in their log of activities when dealing with computers?

Accepted Answer

A forensic accountant should keep a log of activities that includes names, dates, times, and computer serial numbers when dealing with computers. This information is crucial for tracing the source of any evidence that is found and maintaining a chain of custody. Keeping track of the programs used and items found may also be helpful, but it is not as important as the basic identifying information of the computer itself. Network types and viruses found may be relevant in certain cases, but they are not essential to document in every case.

Question 11

In the court system, obtaining forensic identification is often not enough to convict a suspect.

Accepted Answer

While forensic identification can provide strong evidence, it is ultimately up to the prosecution to prove guilt beyond a reasonable doubt using all available evidence. Forensic evidence is often just one piece of the puzzle in a criminal case.

Question 12

When the physical evidence can be specifically and unequivocally linked to a particular object or person, then the investigators have achieved:

Accepted Answer

Forensic identification is the process of linking physical evidence to a specific object or person unequivocally, which is crucial in criminal investigations to establish connections between evidence and potential suspects or crime scenes.

Question 13

The Locard Exchange Principle says that "every contact leaves a trace."

Accepted Answer

The Locard Exchange Principle is a fundamental concept in forensic science, which states that whenever two objects come into contact, there will be an exchange of materials between them. This exchange can take many forms, such as fibers, DNA, or fingerprints, and allows forensic experts to link people or things to specific locations or events. Therefore, the principle supports the idea that "every contact leaves a trace," which is crucial for solving crimes and identifying suspects.

Question 14

How does Cache Storage work inside of a computer?

Accepted Answer

The answer of How does Cache Storage work inside of...

Question 15

What does a packet sniffer do?

Accepted Answer

A packet sniffer captures and copies certain types of data packets as they are transmitted across a network, allowing the person using it to analyze or store the information for later use. It does not replicate data, manipulate computers, or force email programs to send false messages.

Question 16

If a computer that needs to be investigated is currently turned off, what should be done?

Accepted Answer

If a computer that needs to be investigated is currently turned off, it should not be turned back on. Turning it on can potentially alter or delete crucial evidence. The best practice is to leave the computer in its current state and involve trained professionals to conduct a forensic examination.

Question 17

Forensic accountants should be familiar with computer forensic procedures.

Accepted Answer

Forensic accountants often have to analyze electronic data to investigate financial crimes or fraud. Therefore, they should have knowledge of computer forensic techniques and procedures for the preservation, collection, and analysis of digital evidence.

Question 18

Forensic Accountants have blanket authority to investigate crimes and do not need specific permission from a DA or judge to look into crimes.

Accepted Answer

Forensic Accountants do not have blanket authority and do require permission from a DA or judge to investigate certain crimes. They also typically cannot make arrests and must work in conjunction with law enforcement authorities.

Question 19

How can a user fake their IP address?

Accepted Answer

The correct way for a user to fake their IP address is through spoofing, which involves altering the headers of data packets to make it appear as though the user's IP address is different than it actually is. Using a packet sniffer or spamming are not effective ways to fake an IP address.

Question 20

Forensic Accountants may become a part of other forensic science specialties.

Accepted Answer

Forensic accountants may work in conjunction with other forensic specialists, such as forensic scientists, computer forensic experts, and forensic psychologists, among others. This collaboration allows for a more comprehensive investigation and analysis of financial crimes and the gathering of evidence for court proceedings.

Quiz 11: Fraud Examination Evidence III: Forensic Science and Computer Forensics