Question 1

The severity and the category of cybercrime largely determine how much digital evidence is collected.

Accepted Answer

The severity and category of a cybercrime often dictate the extent and depth of the investigation, including how much digital evidence is collected, to ensure a thorough understanding and prosecution of the case.

Question 2

The updated ACPO recommendation for seizing a running computer is to pull the electrical cord from the back of the computer.

Accepted Answer

The Association of Chief Police Officers (ACPO) guidelines recommend first attempting to use the computer's normal shutdown process to preserve data integrity, rather than pulling the electrical cord, which could result in loss of data.

Question 3

A sound forensic practice is to make at least two copies of digital evidence and to confirm that at least one of the copies was successful and can be accessed on another computer.

Accepted Answer

Making at least two copies of digital evidence ensures that there is a backup in case one copy is damaged or lost, and verifying that at least one copy can be accessed on another computer confirms the integrity and accessibility of the copied data, which is essential for forensic analysis and legal proceedings.

Question 4

When a computer is to be moved or stored, evidence tape should be put around the main components of the computer in such a way that any attempt to open the casing or use the computer will be evident.

Accepted Answer

Evidence tape is used to secure and indicate if a computer or its components have been tampered with, ensuring the integrity of the device for forensic analysis or storage.

Question 5

"dd" is the only way to make a bitstream copy.

Accepted Answer

There are multiple tools and commands available for making a bitstream copy, such as "dd", "dcfldd", "ddrescue", and various forensic imaging tools like FTK Imager.

Question 6

At a crime scene, digital evidence will be found on the computer, on mobile devices, and on shelves, bookcases, and the area surrounding the computer. Therefore, there is no need to search the garbage for evidence.

Accepted Answer

Digital evidence can also be found in less obvious places such as the garbage, where discarded items like printed emails, old storage devices, or notes with passwords might be disposed of, making it important to search all potential areas for evidence.

Question 7

Given the risks of collecting a few files only, in most cases it is advisable to preserve the full contents of the disk.

Accepted Answer

Preserving the full contents of a disk ensures that all potential evidence is retained, mitigating the risk of overlooking important data that might be found in files not initially considered relevant.

Question 8

Under independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, a reasonable compromise is to duplicate the

Accepted Answer

Under the independent component doctrine, if a computer system must remain in place but it is necessary to take the original hard drive, duplicating the hard drive is considered a reasonable compromise. This allows for the preservation of evidence while minimizing disruption to the owner's use of the computer system.

Question 9

It is not prudent to document the evidence more than one way.

Accepted Answer

Documenting evidence in multiple ways (e.g., photographs, written descriptions, digital records) ensures thoroughness and redundancy, which can be crucial for verification and legal processes.

Question 10

Computers used to store and analyze digital evidence should be connected to the Internet, so that online research can be conducted.

Accepted Answer

Computers used to store and analyze digital evidence should not be connected to the Internet to prevent contamination or alteration of the evidence and to maintain the integrity of the investigation.

Question 11

List the class and individual characteristics of each of the following:
- A JPEG file
- A thumb drive
- A user manual with handwritten notes

Accepted Answer

The answer of List the class and individual characteristics of...

Quiz 16: Applying Forensic Science to Computers