Deck 4: Processing Crime and Incident Scenes

Question 1

The Fourth Amendment states that only warrants "particularly describing the place to be searched and the persons ​or things to be seized" can be issued. The courts have determined that this phrase means a warrant can authorize a search of a specific place for ​anything.​

Answer 1

False

Question 2

An emergency situation under the PATRIOT Act is defined as the immediate risk of death or personal ​injury, such as finding a bomb threat in an e-mail.

Answer 2

True

Question 3

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?​

A)United States v. Wong​
B)​United States v. Carey
C)United States v. Salgado
D)United States v. Walser

Answer 3

C

Question 4

What should you do while copying data on a suspect's computer that is still live?​

A)​Open files to view contents.
B)​Make notes regarding everything you do.
C)Conduct a Google search of unknown extensions using the computer.
D)Check Facebook for additional suspects.

Question 5

Computer-stored records are data the system maintains, such as system log files and proxy server logs​.

Question 6

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.​

Question 7

_______ does not recover data in free or slack space.

A)Raw format acquisition
B)​Live acquisition
C)Static acquisition
D)Sparse acquisition

Question 8

_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.

A)​Second-party evidence
B)​Rumor
C)Fiction
D)Hearsay

Question 9

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

A)​two
B)​five
C)one
D)three

Question 10

​What does FRE stand for?

A)​Federal Rules of Evidence
B)​Federal Regulations for Evidence
C)Federal Rights for Everyone
D)Federal Rules for Equipment

Question 11

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.​

A)​probable cause
B)​due diligence
C)accusations
D)reliability

Question 12

The term _______ describes rooms filled with extremely large disk systems that are typically used by large business data centers.

A)​storage room
B)​server farm
C)data well
D)storage hub

Question 13

What type of media has a 30-year lifespan?​

A)​DVD-Rs
B)​DLT magnetic tape
C)hard drive
D)USB thumb drive

Question 14

_______ is a common cause for lost or corrupted evidence.

A)​Public access
B)​Not having enough people on the processing team
C)Having an undefined security perimeter
D)Professional curiosity

Question 15

In cases that involve dangerous settings, what kind of team should be used to recover evidence from the scene?​

A)​B-Team
B)​HAZMAT
C)CDC First Responders
D)SWAT

Question 16

To investigate employees suspected of improper use of company digital assets, a company policy statement about misuse of digital assets allows corporate investigators to conduct covert surveillance with little or no cause, and access company computer systems and digital devices without a warrant.​

Question 17

_______ would not be found in an initial-response field kit.

A)​Computer evidence bags (antistatic bags)
B)​Leather gloves and disposable latex gloves
C)A digital camera with extra batteries or 35mm camera with film and flash
D)External USB devices or a portable hard drive

Question 18

You must abide by the _______ while collecting evidence.

A)​Fourth Amendment
B)​Federal Rules of Evidence
C)state's Rules of Evidence
D)Fifth Amendment

Question 19

A _______ is not ​a private sector organization.

A)​small to medium business
B)​large corporation
C)non-government organization
D)hospital

Question 20

Which of the following is not done when preparing for a case?​

A)​Describe the nature of the case.
B)​Identify the type of OS.
C)Set up covert surveillance.
D)Determine whether you can seize the computer or digital device.

Question 21

The ______________ rule states that to prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required.

Question 22

When seizing digital evidence in criminal investigations, whose standards should be followed??

A)?U.S. DOJ
B)ISO?/ IEC?
C)IEEE
D)ITU

Question 23

Match the terms with the correct definitions?.

-The standard specifying whether a police officer has the right to make an arrest, conduct a personal or property search, or obtain a warrant for arrest

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 24

Match the terms with the correct definitions?.

-?Data the system maintains, such as system log files and proxy server logs

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 25

Which system below can be used to quickly and accurately match fingerprints in a database?​

A)​Fingerprint Identification Database (FID)
B)​Systemic Fingerprint Database (SFD)
C)Automated Fingerprint Identification System (AFIS)
D)Dynamic Fingerprint Matching System (DFMS)

Question 26

Match the terms with the correct definitions?.

-Detecting data transmissions to and from a suspect's computer? and a network server to determine the type of data being transmitted over a network

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 27

Match the terms with the correct definitions?.

-A value created by an encryption utility's secret key?

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 28

In the United States, ____________ and similar agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws, and make certain documents available as public records.

Question 29

_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.

A)​Hospitals
B)​ISPs
C)Law firms
D)News networks

Question 30

The term _______ is used to describe someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.

A)​criminal
B)​potential data source
C) person of interest
D)witness

Question 31

Match the terms with the correct definitions?.

-A mathematic algorithm that translates a file into a unique hexadecimal value

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 32

Instead of producing hard disks in court, attorneys can submit ______ copies of files as evidence.​

Question 33

​The ____________________ doesn't extend to supporting a general exploratory search from one object to another unless something incriminating is found.

Question 34

Match the terms with the correct definitions?.

-A portable kit containing only the minimum ?tools needed to perform disk acquisitions and preliminary forensics analysis in the field

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 35

Match the terms with the correct definitions?.

-?An algorithm that produces a hexadecimal value of a file or storage media; used to determine whether data has changed

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 36

Match the terms with the correct definitions?.

-?A unique hash number generated by a software tool and used to identify files

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 37

​As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

A)​The power cable should be pulled.
B)​The system should be shut down gracefully.
C)The power should be left on.
D)The decision should be left to the Digital Evidence First Responder (DEFR).

Question 38

Match the terms with the correct definitions?.

-Electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word-processing document

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 39

Match the terms with the correct definitions?.

-?A portable kit designed to process several computers and a variety of operating systems at a crime or incident scene involving computers

A)?Computer-generated records
B)Keyed hash set?
C)?Cyclic Redundancy Check
D)?Message Digest 5
E)?Computer-stored records
F)?Probable cause
G)?Extensive-response field kit
H)Sniffing
I)?Nonkeyed hash set
J)Initial-response field kit

Question 40

​
________________ can be any information stored or transmitted in digital form.​

Question 41

With digital evidence, you need to consider how and on what type of media to save it and what type of storage device is recommended to secure it. ​The media you use to store digital evidence usually depends on how long you need to keep it. If you investigate criminal matters, store the evidence as long as you can. Name five ideal media types on which to store digital data.

Question 42

Like most common law nations, the United States excludes hearsay as spelled out in the FRE Article VIII, Rule 802. Rules 803 and 804 cite more than 20 exceptions for when hearsay can​ be used. Provide five examples that apply to digital forensics investigations.

Question 43

At a scene, technical advisors can help direct other investigators to collect evidence correctly. List the responsibilities of technical advisors.

Question 44

Describe the steps to take if you discover evidence of a crime during a company policy investigation​.

Question 45

Describe the steps that must be taken to create image file?s.

Question 46

Consistent practices help verify your work and enhance your credibility, so you must handle all evidence consistently. Explain why it's important to apply the same security and accountability controls for evidence in a civil lawsuit as in a major crime.

Question 47

​The plain view doctrine states that objects falling in the direct sight of an officer who has the right to be in a location are subject to seizure without a warrant and can be introduced into evidence. Provide the three criteria that must be met in order for the plain view doctrine to apply.

Question 48

To verify data integrity, different methods of obtaining a unique identity for file data have been developed. Explain how you can use Cyclic Redundancy Check (CRC) and Message Digest 5 (MD5)​​ for this purpose.

Question 49

After you record the scene and shut down the system, you bag and tag the evidence. Describe the steps to follow for bagging and tagging evidence.?

Question 50

Compare and contrast hashing methods using a ​keyed hash set​ and a ​nonkeyed hash set​.