Question 1

If it is determined that some hardware should be collected, but there is no compelling need to collect everything, the most sensible approach is to employ:
A) Nearest reach doctrine
B) Direct connectivity doctrine
C) Independent component doctrine
D) Slice-the-pie doctrine

Accepted Answer

The Independent component doctrine suggests collecting only the necessary components rather than everything, aligning with the need to collect some but not all hardware.

Question 2

The forensic crime scene processing kit should include all of the following, EXCEPT:
A) Evidence bags, tags, and other items to label and package evidence
B) Forensically sanitized hard drives to store acquired data
C) Compilers for developing forensic tools on site
D) Hardware write blockers

Accepted Answer

Compilers for developing forensic tools on site are not typically included in a forensic crime scene processing kit. These kits focus on evidence collection and preservation, rather than the development of forensic tools, which is usually done in a controlled environment prior to field deployment.

Question 3

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

Accepted Answer

While computer systems are important, the investigator should also consider other digital devices such as smartphones, tablets, digital cameras, and any other electronic devices that could contain relevant evidence.

Question 4

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.
A) Evidence inventory
B) Chain of custody
C) Evidence intake
D) Preservation notes

Accepted Answer

The chain of custody documents who handled the evidence, when it was handled, where it was handled, and for what purpose, ensuring the integrity and security of the evidence from collection to presentation in court.

Question 5

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?
A) Running processes
B) Open network ports
C) Data stored in memory
D) System date and time

Accepted Answer

The system date and time are not lost when a computer is shut down because they are maintained by the system's Real-Time Clock (RTC) and powered by a small battery on the motherboard, ensuring that this information persists even when the computer is powered off.

Question 6

A forensic crime scene processing kit should contain quantities of those items used to process computer equipment.

Accepted Answer

Forensic crime scene processing kits should contain quantities of those items used to process computer equipment because computers can contain valuable evidence in criminal investigations.

Question 7

When documenting a crime scene, the computer and surrounding area should be photographed, detailed sketches should be made, and copious notes should be taken, because:
A) The more evidence collected, the stronger the case.
B) This provides a record for what to look for when you return for the second visit.
C) It is prudent to document the same evidence in several ways.
D) All of the above.

Accepted Answer

Documenting evidence in multiple ways ensures accuracy, thoroughness, and reliability, which is crucial for legal proceedings.

Question 8

When processing the digital crime scene, one aspect of surveying for potential sources of digital evidence is:
A) Recognizing relevant hardware such as computers, removable media, etc.
B) Determining if electrical wiring is capable of supporting forensic machines
C) Confirming that the operating environment is suitable for electronic equipment
D) Making sure there is sufficient space to set up the forensic crime scene processing kit

Accepted Answer

Recognizing relevant hardware such as computers, removable media, etc., is crucial in identifying potential sources of digital evidence during the survey of a digital crime scene. This step ensures that all digital devices that may contain evidence are accounted for and properly analyzed.

Question 9

Which of the following is NOT one of the recommended approaches to preserving digital evidence?
A) Place the evidential computers and storage media in secure storage for later processing.
B) Preview the evidential computer, taking appropriate notes.
C) Extract just the information needed from evidential computers and storage media.
D) Acquire everything from evidential computer and storage media.

Accepted Answer

Previewing the evidential computer can alter the evidence, making it less reliable.

Question 10

Which of the following is NOT part of the set of forensic methodologies referenced in this book?
A) Preparation
B) Interdiction
C) Documentation
D) Reconstruction

Accepted Answer

Interdiction is not typically listed as part of the standard set of forensic methodologies. Forensic methodologies often include steps like preparation, documentation, and reconstruction, which are focused on collecting, preserving, and analyzing evidence. Interdiction, on the other hand, refers to the act of preventing something, especially with respect to law enforcement or military operations, and is not a standard part of forensic process.

Question 11

Preparation planning prior to processing a crime scene should include:
A) What computer equipment to expect at the site
B) What the systems are used for
C) Whether a network is involved
D) All of the above

Accepted Answer

Preparation planning should consider all aspects of the crime scene, including the type of computer equipment, the purpose of the systems, and the involvement of a network, to ensure a comprehensive and effective investigation.

Question 12

The reason UNIX "dd" is considered a de facto standard for making bitstream copies is:
A) The majority of tools for examining digital evidence can interpret bitstream copies.
B) "dd" stands for "digital data" and was developed for making forensic copies.
C) "dd," although a UNIX tool, is universally able to traverse Windows file systems.
D) The developers of "dd" have made arrangements with other forensic software companies.

Accepted Answer

"dd" is widely used in digital forensics because it creates bitstream copies, which are exact replicas of digital evidence. These copies can be analyzed by most forensic tools, making "dd" a de facto standard in the field.

Question 13

A crime scene investigator decides to collect the entire computer. In addition, he decides to collect all of the peripheral devices associated with that computer. What reason could he give to justify this?
A) It is especially important to collect peripheral hardware related to the type of digital evidence one would expect to find in the computer.
B) Since the computer is being collected, the suspect has no need for the peripherals.
C) The presence of the peripheral devices is essential to imaging the suspect hard drive.
D) None of the above.

Accepted Answer

Peripheral devices can contain important evidence or be integral to understanding how the computer was used, which is crucial in digital forensic investigations.

Question 14

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

Accepted Answer

Knowing the types of computer equipment at a crime scene beforehand can help investigators bring the right tools and have a strategy for collecting digital evidence efficiently.

Question 15

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

Accepted Answer

Chain of custody documents are essential in legal contexts to maintain the integrity of evidence by recording each person who handled the evidence, along with the dates, locations, and reasons for handling, ensuring the evidence remains untampered and credible.

Question 16

The file signature of a Microsoft Word document is an example of what type of characteristic?
A) An individual characteristic
B) A class characteristic
C) An intermediate characteristic
D) A medial characteristic

Accepted Answer

The file signature of a Microsoft Word document is a class characteristic because it is a trait or feature shared by all Microsoft Word documents, distinguishing them from files created by other software.

Question 17

In regard to preservation, in a child pornography investigation, which of the following should be collected?
A) Photographs
B) Papers
C) Digital cameras
D) All of the above

Accepted Answer

All of the above should be collected in a child pornography investigation because they may contain evidence of the crime.

Question 18

Regarding the examination of a piece of digital evidence, which of the following is NOT one of the fundamental questions that need to be answered?
A) What is it (identification)?
B) What classifications distinguish it?
C) Where did it come from?
D) What is its value?

Accepted Answer

The fundamental questions typically focus on identification, classification, and origin, rather than assessing the value of the evidence.

Question 19

According to the us Federal guidelines for searching and seizing computers, safe temperature ranges for most magnetic media are:
A) 60-80 degrees Fahrenheit
B) 50-90 degrees centigrade
C) 50-90 degrees Fahrenheit
D) 60-80 degrees centigrade

Accepted Answer

The safe temperature range for most magnetic media, according to US Federal guidelines for searching and seizing computers, is 50-90 degrees Fahrenheit. This range helps prevent data loss or damage to the media.

Question 20

Since computer seizures usually happen pretty much the same way, there is no real need to do any pre-planning.

Accepted Answer

Each computer seizure can present unique challenges, such as different operating systems, encryption, or network configurations, necessitating tailored pre-planning to ensure data integrity and access.

Quiz 16: Applying Forensic Science to Computers

If it is determined that some hardware should be collected, but there is no compelling need to collect everything, the most sensible approach is to employ:

The forensic crime scene processing kit should include all of the following, EXCEPT:

When surveying the crime scene for hardware, the investigator should focus on the computer systems since that is where most of the important evidence will be.

The _______________documentation specifies who handled the evidence, when, where, and for what purpose.

Which of the following is NOT an artifact that will be irrevocably lost if the computer is shut down?

A forensic crime scene processing kit should contain quantities of those items used to process computer equipment.

When documenting a crime scene, the computer and surrounding area should be photographed, detailed sketches should be made, and copious notes should be taken, because:

When processing the digital crime scene, one aspect of surveying for potential sources of digital evidence is:

Which of the following is NOT one of the recommended approaches to preserving digital evidence?

Which of the following is NOT part of the set of forensic methodologies referenced in this book?

Preparation planning prior to processing a crime scene should include:

The reason UNIX "dd" is considered a de facto standard for making bitstream copies is:

A crime scene investigator decides to collect the entire computer. In addition, he decides to collect all of the peripheral devices associated with that computer. What reason could he give to justify this?

If possible, prior to entering a crime scene, it is useful to try and determine what kind of computer equipment to expect.

Chain of custody documents record who handled the evidence, when, where, and for what purpose.

The file signature of a Microsoft Word document is an example of what type of characteristic?

In regard to preservation, in a child pornography investigation, which of the following should be collected?

Regarding the examination of a piece of digital evidence, which of the following is NOT one of the fundamental questions that need to be answered?

According to the us Federal guidelines for searching and seizing computers, safe temperature ranges for most magnetic media are:

Since computer seizures usually happen pretty much the same way, there is no real need to do any pre-planning.