Question 1

At what point should computer security professionals stop handling digital evidence and contact law enforcement?

Accepted Answer

The answer of At what point should computer security professionals...

Question 2

Forensic science is the application of science to investigation and prosecution of crime or to the just resolution of conflict.

Accepted Answer

Forensic science applies scientific methods and principles to analyze physical evidence in legal cases, aiding in the investigation and prosecution of crime or in resolving disputes justly.

Question 3

What are the three general categories of computer systems that can contain digital evidence? In each category, give a specific source of digital evidence that interests you and describe the type of evidence that you might find.

Accepted Answer

The answer of What are the three general categories of...

Question 4

Computers can be used by terrorists to detonate bombs.

Accepted Answer

Computers can be programmed or used remotely to trigger explosive devices, making them a tool for terrorists in bomb detonation.

Question 5

Digital evidence is always circumstantial.

Accepted Answer

Digital evidence can be both direct and circumstantial, depending on how it relates to the fact in question. Direct evidence directly proves a fact, while circumstantial evidence requires an inference to connect it to a conclusion of fact.

Question 6

Computer professionals who take inappropriate actions when they encounter child pornography on their employer's systems can lose their jobs or break the law.

Accepted Answer

Computer professionals are legally and ethically obligated to report child pornography to the authorities. Failure to do so or mishandling such situations can lead to legal consequences and job termination.

Question 7

The aim of a forensic examination is to prove with certainty what occurred.

Accepted Answer

The aim of a forensic examination is to collect and analyze evidence to support a hypothesis about what happened, but it does not prove with certainty what occurred, as it can only provide information that supports or contradicts a version of events.

Question 8

When criminals use computers, what advantages does this have from an investigative standpoint?

Accepted Answer

The answer of When criminals use computers, what advantages does...

Question 9

What are the main challenges of investigating computer-related crime?

Accepted Answer

The answer of What are the main challenges of investigating...

Question 10

Even digital investigations that do not result in legal action can benefit from principles of forensic science.

Accepted Answer

Even if a digital investigation does not lead to legal action, applying forensic science principles ensures the integrity and reliability of the investigation process, making findings more credible and useful for internal decision-making or future reference.

Question 11

What is the difference between digital evidence, electronic evidence, and computer evidence?

Accepted Answer

The answer of What is the difference between digital evidence,...

Question 12

Computers were involved in the investigations into both World Trade Center attacks.

Accepted Answer

Computers were used in the investigations of both the 1993 bombing and the September 11, 2001, attacks on the World Trade Center to analyze evidence, coordinate response efforts, and facilitate communication among various agencies.

Question 13

Automobiles have computers that record data such as vehicle speed, brake status, and throttle position when an accident occurs.

Accepted Answer

Modern automobiles are equipped with Event Data Recorders (EDRs), often referred to as "black boxes," which record various data points such as vehicle speed, brake status, throttle position, and more, especially in the moments leading up to and during a crash.

Question 14

When a file is deleted from a hard drive, it can often be recovered.

Accepted Answer

When a file is deleted, the data often remains on the hard drive but the space it occupies is marked as available for new data. Until that space is overwritten, recovery software can often retrieve the deleted file.

Question 15

Why is it important for computer security professionals to become familiar with digital evidence?

Accepted Answer

The answer of Why is it important for computer security...

Question 16

Digital evidence alone can be used to build a solid case.

Accepted Answer

Digital evidence must be corroborated with other forms of evidence and context, as it can be manipulated or misinterpreted without additional supporting information or verification.

Quiz 1: Foundations of Digital Forensics