Question 1

An Expert witness give an opinion if:

Accepted Answer

An expert witness provides an opinion when it involves specialized knowledge, skill, or training that is beyond the ordinary experience of lay jurors, helping them understand complex evidence or issues.

Question 2

You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

Accepted Answer

The answer of You have completed a forensic investigation case....

Question 3

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

Accepted Answer

Office Documents can contain a Globally Unique Identifier (GUID) which can be used to track the unique identifier of the machine that created the document.

Question 4

When cataloging digital evidence, the primary goal is to

Accepted Answer

The primary goal when cataloging digital evidence is to preserve evidence integrity, ensuring that the data remains unchanged and uncontaminated throughout the investigation process.

Question 5

You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

Accepted Answer

The E-mail Header contains detailed information about the path and origin of the email, including IP addresses and server information, which are crucial for tracing the source of the message.

Question 6

A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

Accepted Answer

Probable cause is the standard required for law enforcement to conduct a search and seizure, as it involves facts or circumstances that would lead a reasonable person to believe a crime has been or is about to be committed.

Question 7

Printing under a Windows Computer normally requires which one of the following files types to be created?

Accepted Answer

Enhanced Metafile (EMF) is a file format used in Windows for printing graphics and documents. It is a standard format for printing tasks.

Question 8

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a . jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

Accepted Answer

The file header contains metadata that indicates the file type, allowing investigators to verify if the file extension matches the actual file type.

Question 9

The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

Accepted Answer

The Silver-Platter Doctrine refers to the practice of handing over evidence obtained by private individuals or state officials to federal authorities, especially when it indicates criminal activity.

Question 10

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

Accepted Answer

The logic, formatting, and elegance of the code used in the attack can provide insights into the skill level, style, and possibly the identity of the hacker, which is crucial for profiling.

Question 11

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?

Accepted Answer

An employer can file a criminal complaint with the police if they find evidence of a crime during an investigation. They can turn over all evidence to the police, as private investigations do not require warrants or adherence to police procedures.

Question 12

You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

Accepted Answer

Grep is a command-line utility used for searching plain-text data for lines that match a regular expression, making it efficient for searching strings within files.

Question 13

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

Accepted Answer

Computer Forensics is the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

Question 14

This organization maintains a database of hash signatures for known software.

Accepted Answer

The National Software Reference Library (NSRL) maintains a database of hash signatures for known software, which is used by law enforcement and other organizations to identify and verify software.

Question 15

The police believe that Melvin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

Accepted Answer

The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before conducting a search.

Question 16

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

Accepted Answer

The 'dd' command is a standard Unix/Linux utility used to convert and copy files, and it can create bit-stream images. It is also available on Windows through third-party tools like 'dd for Windows'.

Question 17

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

Accepted Answer

A hardware write-blocking device is used to prevent any changes or contamination to the evidence drive during the acquisition process.

Question 18

To preserve digital evidence, an investigator should ____________________.

Accepted Answer

Making two copies of each evidence item using different imaging tools ensures redundancy and verification of the integrity of the copies, which is crucial for preserving digital evidence.

Question 19

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

Accepted Answer

Conducting an investigation without a policy can violate the employee's expectation of privacy, as employees may assume their activities are private if not explicitly informed otherwise.

Question 20

You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:

Accepted Answer

Monitoring network traffic at the request of law enforcement would make you an agent of law enforcement, which could have legal and ethical implications.

Exam 2: Certified Network Defender