Question 1

What keeps track of the location of files and folders on the HDD?

Accepted Answer

The File Allocation Table (FAT) keeps track of the location of files and folders on the HDD. It acts as a map that shows the location of each file on the disk.

Question 2

The ultimate goal of obtaining an image of a hard disk drive is to:

Accepted Answer

The ultimate goal of obtaining an image of a hard disk drive is to do so without altering the drive in any way. This is because any alteration can potentially damage or destroy the data on the drive, and it may also render the evidence inadmissible in court. The purpose of creating a forensic image is to make an exact copy of the original drive so that investigators can perform analysis and investigation on the copy, without risking damage or changes to the original. Therefore, choice A is the correct answer.

Question 3

When is it necessary to make a "fingerprint" of a HDD?

Accepted Answer

Creating a "fingerprint" of a HDD, which refers to generating a unique hash value to verify the integrity of the data, is crucial before and after imaging its contents. This ensures that the original data has not been altered during the imaging process.

Question 4

Which of the following is NOT considered a type of software?

Accepted Answer

Random Access Memory (RAM) is a hardware component and is not considered a type of software. The other options listed are all examples of software.

Question 5

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

Accepted Answer

The answer of The first thing a crime scene investigator...

Question 6

The primary form of data storage within a personal computer is:

Accepted Answer

The hard disk drive is the primary form of data storage within a personal computer. This is where the operating system, software programs, and user files are stored. CD-ROMs, zip drives, and thumb drives are all secondary forms of data storage and are typically used for backup or portable storage purposes. The recycle bin is not a form of data storage, but rather a temporary holding place for deleted files until they are permanently removed from the computer.

Question 7

A motherboard:

Accepted Answer

A motherboard has a socket to accept RAM, connects to every device used by the system, and is the main circuit board within a computer. All of the options listed are correct, so the best choice is D, all of the above.

Question 8

A cluster is a group of ________ in multiples of ________.

Accepted Answer

Clusters are groups of sectors on a hard drive. They are typically organized in multiples of two for compatibility with different file systems. Therefore, the correct answer is C - sectors in multiples of two.

Question 9

Evidentiary data may be recovered from which of the following?

Accepted Answer

All three options - RAM swap files, unallocated space on the HDD, and slack space on the HDD - may contain evidentiary data that can be recovered during a forensic investigation. RAM swap files may contain remnants of data that was previously stored in the system's memory, unallocated space on the HDD may contain deleted files, and slack space on the HDD may contain fragments of data that were not completely overwritten by new data. Therefore, the best choice is D, as all options may yield useful evidentiary data.

Question 10

One gigabyte can be expressed as:

Accepted Answer

One gigabyte is equal to 1,000 megabytes.

Question 11

Which of the following is NOT considered a hardware device?

Accepted Answer

The operating system is a software program, not a hardware device. The other options listed are all hardware devices.

Question 12

Which of the following is NOT a type of RAM?

Accepted Answer

DAB is not a type of RAM. The other choices are all valid types of RAM: B) SSIM (Synchronous Static Random Access Memory), C) SD (Synchronous Dynamic Random Access Memory), and D) DDIM (Double Data Rate Inline Memory Module).

Question 13

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

Accepted Answer

All the options listed - internet "cookies", internet history, and cache - can be potential sources of forensic evidence on a suspect's personal computer. Therefore, the best choice is D (all of the above).

Question 14

One of the most common places to begin to look for evidential data is in:

Accepted Answer

Word processing or text-based document files are the most common places to find evidential data as they often contain written communication and information about the user's activities. Spreadsheet files and CAD packages may contain useful data, but they are less commonly used for personal communication and may require specialized knowledge to interpret. Learn-to-type tutorials and photograph editing programs are unlikely to contain relevant evidential data.

Question 15

A Network Interface Card (NIC) enables a personal computer to communicate with other computers via:

Accepted Answer

A Network Interface Card (NIC) can enable a personal computer to communicate with other computers via a wired connection or a wireless connection. However, satellite connections require additional hardware and are not typically supported by standard NICs. Therefore, the best choice(s) are A and B only.

Question 16

Which of the following is NOT associated with the partitioning of a HDD?

Accepted Answer

The partitioning of a HDD typically involves dividing the physical disk into logical sections called cylinders, tracks, sectors, and clusters. However, quadrants are not typically used in this process.

Question 17

Which of the following is the best definition of latent data?

Accepted Answer

Latent data refers to data that is hidden from view, such as deleted files or fragments of data leftover from previous actions. It is not readily accessible and requires specialized tools and techniques to recover and analyze.

Question 18

The term bit is short for:

Accepted Answer

The term bit is short for binary digit, which is the smallest unit of measurement for digital data. It can only have two values, 0 or 1, representing off or on in electronic devices.

Question 19

A software algorithm used to create a "fingerprint" of a file or an entire HDD is called:

Accepted Answer

The algorithm used to generate a unique "fingerprint" of a file or hard drive is called MD5 (Message Digest 5). It creates a 128-bit hash value that can be used for data integrity checks and verifying file authenticity. RAM, CPU, ROM, and MAC OS are not related to file fingerprinting.

Question 20

Once a file is deleted by a user, it:

Accepted Answer

When a file is deleted by a user, it is not immediately obliterated from the system. Instead, it is retained until the disk space it occupies is allocated for another use. It is possible to identify and recover deleted files using forensic image acquisition software, which can scan the disk for residual data and reconstruct deleted files. Therefore, both options B and C are correct, making choice E the best answer. Option A is incorrect because the file is not immediately wiped from the system when deleted.

Quiz 18: Computer Forensics