Deck 11: Searching and Seizing Computer-Related Evidence

Question 1

________ are usually characterized by drives without covers, unusual connections, various external media, or cluttered work space.

A) Mainframes
B) Specialty and hacker computers
C) Netbooks and tablets
D) Fuzzy logic tools

Answer 1

B

Question 2

Computer components or media are ________ intemperate environments.

A) not susceptible to
B) not damaged in
C) especially vulnerable to
D) slightly susceptible to

Answer 2

C

Question 3

Which of the following statements applies to all on-scene personnel regardless of their assignment?

A) Final preraid briefings do not include cautionary admonitions.
B) It is unacceptable to compile more equipment than necessary.
C) Traditional procedures for crime-scene investigation remain sacrosanct.
D) Officer safety generally takes a backseat during investigations.

Answer 3

C

Question 4

Which of the following would be in a traditional criminal investigative toolkit?

A) hex editors
B) color scanner
C) multiple boot disks
D) evidence tape

Question 5

Capturing the investigative process on videotape and other such documentation is especially important in cases where violations of ________ are alleged.

A) digital protocol
B) SMEAC
C) the Electronic Communication Privacy Act
D) business ethics

Question 6

Which of the following characterizes viewer forensic software?

A) It enables investigators to view files in hexadecimal formats.
B) It enables investigators to quickly scan the contents of large numbers of computer files.
C) It enables investigators to quickly search for keywords applicable to the current investigation.
D) It enables investigators to capture potential evidence residing in print buffers.

Question 7

Which of the following is true of seizure of equipment?

A) Investigators need not substantiate any request for seizure of equipment.
B) Permission is implicit for seizing all hardware and storage devices.
C) Explicit permission is preferred for seizing all hardware and storage devices.
D) Criminal contraband can be seized only with judicial authority.

Question 8

Computer monitors have proven a popular place for hiding ________, especially for multiple system users.

A) cash
B) passwords
C) pornography
D) wiping programs

Question 9

Which of the following does NOT constitute an on-scene activity in any investigation?

A) warrant preparation
B) knock, notice, and document
C) scene processing
D) securing the crime scene

Question 10

Computer manuals and packaging materials might be useful for investigators for all of the following reasons EXCEPT which?

A) They are legally required for the related hardware to be admitted as evidence.
B) They can alert investigators to hidden programs.
C) They are often a popular place for hiding passwords.
D) They can provide clues about the relative sophistication of the user.

Question 11

Which of the following is NOT an element of probable cause that needs to be articulated to a magistrate in order to secure a warrant?

A) probable cause that a crime has been committed
B) probable cause that the criminal has escaped
C) probable cause that evidence of a crime exists
D) probable cause that extant evidence resides in a particular location

Question 12

Dumpster diving refers to ________ that can provide incriminating digital evidence such as passwords or personal information on suspects.

A) investigators processing any trash
B) reconnaissance outside a suspect scene
C) deleting all data onto an external hard drive
D) criminals throwing into the trash any hardware

Question 13

Tools such as screwdrivers, hex wrenches, and plyers used to open computer boxes should be ________.

A) electric
B) battery-operated
C) magnetic
D) manual

Question 14

An investigation plan that details the background of the suspects relates to which aspect of SMEAC?

A) execution
B) mission
C) communications
D) situation

Question 15

Which of the following circumstances would be considered exigent?

A) potential for evidence destruction
B) presence of resident
C) immaturity of target
D) no prior knowledge of search

Question 16

Extra attention by investigators to the configuration of computer equipment, including connections, and the back of the computer serves the following purposes EXCEPT ________.

A) enabling investigators to fully document to the court the manner in which the scene was processed
B) serving as a refresher for investigators called to testify months or years after the fact
C) enabling investigators to duplicate the original state of the computer in court
D) enabling investigators to apply for a no-knock warrant

Question 17

Which of the following would be in a computer-specific criminal investigative toolkit?

A) forensic software
B) labeling materials
C) mobile carts
D) photographic equipment

Question 18

The arrest team has the responsibility of arresting suspects and ________.

A) interrogating them
B) transporting them in custody
C) physically searching them for evidence
D) seizing their belongings

Question 19

A ________ is critical for the analysis of computer-related evidence and courtroom presentation.

A) boardroom
B) police station
C) fire department
D) forensic laboratory

Question 20

________ ensure data integrity, preventing intentional or accidental manipulation of data.

A) Recovery tools
B) Wiping programs
C) Locking programs
D) Fuzzy logic tools

Question 21

The interview and interrogation team should possess ________.

A) exceptional sketching skills
B) exceptional communication skills
C) bagging and tagging skills
D) supervisory skills

Question 22

Requests for "no-knock" warrants by investigators are not considered even in exigent circumstances.

Question 23

The physical search team is responsible for collection of all potential computer evidence.

Question 24

In the preliminary plan of investigation, the mission paragraph of SMEAC elaborates on how the mission will be accomplished.

Question 25

Investigators searching a computer for emails exchanged on a terrorist attack inadvertently uncover spreadsheets that establish illegal money laundering.A primary warrant will cover both crimes.

Question 26

Faraday bags can shield wireless devices from remote corruption or deletion of data from cellular, WiFi, or radio signals.

Question 27

The first step in the preparation of any warrant application for a computer investigation is the operationalization of the crime and, more specifically, defining the role of the ________ in it.

A) investigator
B) suspect
C) computer
D) police

Question 28

Investigators wear latex gloves to avoid contamination of fingerprints or other potential trace evidence.

Question 29

The seizure team is responsible for bagging and tagging.

Question 30

Which of the following would be least advisable if an investigator's camera ran out of film during a crime-scene investigation?

A) Use the suspect's cell phone to take photos.
B) Borrow film from another investigator.
C) Request the scene photographer to take additional photos.
D) Use the investigator's cell phone to take pictures.

Question 31

At the majority of crime scenes, the execution of the search warrant involves the first step of knock, arrest, and seize.

Question 32

Assessment of digital evidence is typically done by analyzing small samples that preserve the totality of the evidence.

Question 33

Magnetic pulses emitted from car radios and transmitters may ________ computer-related evidence.

A) ensure data integrity of
B) cause information overload in
C) lead to data overload of
D) cause information erasure in

Question 34

Compared to photographs, sketches represent a more focused illustration of applicable evidence.

Question 35

Responsibilities of on-scene case supervisors include information dissemination, and interaction with media.

Question 36

To preserve computer evidence, temperatures should reach no higher than 90° F and no lower than 60° F.

Question 37

Innocuous material such as Post-it notes, discarded media, or packaging material will not help in proving intent in a criminal court.

Question 38

Computer criminals pose the same risks to investigators when compared to traditional suspects.

Question 39

________ allow(s) interviewing of witnesses based on developing evidence, yet may be impossible if there are multiple computers or large drive computers or excessive media.

A) Personnel gathering
B) Warrant preparation
C) Off-site searches
D) On-site searches

Question 40

At a physically and electronically secured site, investigators should gather trace evidence after seizure of electronic evidence.

Question 41

Discuss the five-paragraph SMEAC that should ideally find a place in any investigation plan.

Question 42

The ________ team creates a visible barrier against scene contamination, evidence destruction, and media impropriety.

Question 43

A detailed chain of custody report forms part of ________ specific documentation.

Question 44

SMEAC includes situation, mission, ________, avenues of approach and escape, and communications.

Question 45

Traditional equipment includes evidence tape, used to mark the ________ of the crime scene.

Question 46

________, conductive, and Faraday bags are especially important in the storage, analysis, and transportation of digital evidence.

Question 47

Capturing the entire computer investigation process on ________ is highly recommended.

Question 48

Write-blocking is necessary to negate challenges of corruption or contamination of ________.

Question 49

What steps must be taken to protect computer evidence from getting destroyed, contaminated, or corrupted?

Question 50

Traditional plastic evidence bags may generate levels of ________ dangerous to computer media.

Question 51

________ gathering is critical to the development of a comprehensive warrant for a computer crime.

Question 52

Hacker computers should be approached with great caution as hackers take pains to protect their own systems from ________.

Question 53

Password crackers enable investigators to circumvent many ________ measures employed by the suspect.

Question 54

Computer crime investigations require assessment of ________, which is volatile and voluminous, susceptible to climatic factors as well as human error.

Question 55

Any type of ________ field poses a potentially calamitous risk to computer media and hardware.

Question 56

Why is documentation so important for any successful criminal investigation? List the minimum non-computer-specific documentation required for an investigation.

Question 57

Once evidence has been identified, it is necessary to determine if the evidence is actually ________.

Question 58

Computer components and media are more fragile than some ________ forms of evidence.

Question 59

Discuss why it is considered so important for computer experts to assess digital evidence.What risks do you foresee if noncomputer experts were to handle such evidence?

Question 60

Some investigators proclaim the merits of vagueness and obfuscation in warrant applications.Do you agree that this increases their investigative authority? When are multiple warrants encouraged?