Question 1

_______ is not one of the functions of the investigations triad.

Accepted Answer

The functions of the investigations triad include digital investigations, vulnerability/threat assessment and risk management, and network intrusion detection and incident response. Data recovery is not one of the functions, as it is a specialized service within digital investigations.

Question 2

​The _______ is not one of the three stages of a typical criminal case.

Accepted Answer

The three stages of a typical criminal case are investigation, prosecution, and adjudication. A civil suit is a separate legal action initiated by a plaintiff against a defendant typically involving disputes over contracts, property, or personal injury.

Question 3

All suspected industrial espionage cases should be treated as civil case investigations.​

Accepted Answer

Suspected industrial espionage cases can also be criminal cases as the theft of trade secrets is a federal crime in the United States. Therefore, such investigations can involve both civil and criminal proceedings.

Question 4

In what year was the Computer Fraud and Abuse Act passed?​

Accepted Answer

The Computer Fraud and Abuse Act was passed in 1986. This law was passed to address computer-related crimes and unauthorized access to computer systems. It has been amended several times since its inception.

Question 5

Most digital investigations in the private sector involve misuse of computing assets.

Accepted Answer

According to industry studies, the majority of digital investigations in the private sector involve misuse of computing assets such as employee theft of intellectual property, fraud, and harassment.

Question 6

​After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

Accepted Answer

The Digital Evidence First Responder is typically responsible for the collection of evidence as defined by the warrant.

Question 7

​Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

Accepted Answer

Repeatable findings refer to the ability to perform the same steps multiple times and obtain consistent results, which is crucial in scientific and computing investigations for ensuring the accuracy and validity of the findings. The other choices are not directly related to this concept.

Question 8

The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.

Accepted Answer

The answer of The _______ is responsible for analyzing data...

Question 9

​After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

Accepted Answer

After hearing all the evidence, a jury must deliver a verdict, which is its decision on the guilt or innocence of the defendant.

Question 10

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?​

Accepted Answer

ILook is a forensic tool maintained by the IRS Criminal Investigation Division and is specifically designed for law enforcement use to analyze and read copies of disks.

Question 11

Which Microsoft OS below is the least intrusive to disks in terms of changing data?​

Accepted Answer

MS-DOS 6.22 is a command-line operating system and doesn't have any background processes that could interfere with data on the disk. It also doesn't have any advanced features which can accidentally cause data loss.

Question 12

A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.

Accepted Answer

A chain-of-evidence form, also known as an evidence custody form, is used to document the custody and control of evidence, including what has and has not been done with the original evidence and forensic copies of the evidence. This helps ensure the integrity and admissibility of the evidence in court. Single-evidence form and multi-evidence form are not commonly used terms in forensic documentation. Evidence tracking form may refer to a different type of form used to track evidence through a laboratory or facility.

Question 13

User groups for a specific type of system can be very useful in a forensics investigation.​

Accepted Answer

User groups can provide insight into who had access to specific parts of a system, and what actions they were authorized to perform. This can help narrow down suspects and identify potential sources of malicious activity.

Question 14

​An evidence custody form does not usually contain _______.

Accepted Answer

The answer of ​An evidence custody form does not usually...

Question 15

Which option below is not a standard systems analysis step?​

Accepted Answer

Sharing evidence with experts outside of the investigation may compromise the integrity of the investigation and is not a standard systems analysis step. The other options listed are standard steps in the process.

Question 16

​According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

Accepted Answer

The answer of ​According to the National Institute of Standards...

Question 17

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.​

Accepted Answer

When a police officer or investigator has sufficient cause to support a search warrant, they are required to submit an affidavit to the prosecuting attorney. The affidavit must contain evidence supporting the need for a search warrant.

Question 18

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.​

Accepted Answer

This statement is true. When you work under the direction of law enforcement, you are considered to be an agent of law enforcement and are subject to the same restrictions and guidelines as law enforcement agents. This includes respecting the Fourth Amendment protections for individuals against unreasonable searches and seizures.

Question 19

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?​

Accepted Answer

The Fourth Amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure without a warrant or probable cause. This amendment is a crucial protection of individuals' privacy and civil liberties.

Question 20

_______ is not recommended for a digital forensics workstation.

Accepted Answer

Remote access software is not recommended for a digital forensics workstation because it can introduce security vulnerabilities and risks of unauthorized access, potentially compromising the integrity of the forensic investigation.

Quiz 1: Understanding the Digital Forensics Profession and Investigations

_______ is not one of the functions of the investigations triad.

​The _______ is not one of the three stages of a typical criminal case.

All suspected industrial espionage cases should be treated as civil case investigations.​

In what year was the Computer Fraud and Abuse Act passed?​

Most digital investigations in the private sector involve misuse of computing assets.

​After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

​Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.

​After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?​

Which Microsoft OS below is the least intrusive to disks in terms of changing data?​

A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.

User groups for a specific type of system can be very useful in a forensics investigation.​

​An evidence custody form does not usually contain _______.

Which option below is not a standard systems analysis step?​

​According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.​

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.​

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?​

_______ is not recommended for a digital forensics workstation.

The _______ is not one of the three stages of a typical criminal case.

All suspected industrial espionage cases should be treated as civil case investigations.

In what year was the Computer Fraud and Abuse Act passed?

After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?

Which Microsoft OS below is the least intrusive to disks in terms of changing data?

User groups for a specific type of system can be very useful in a forensics investigation.

An evidence custody form does not usually contain _______.

Which option below is not a standard systems analysis step?

According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?