Deck 19: Computer Forensics

Question 1

Which of the following is NOT classified as software?

A)Operating systems
B)Word processors
C)Web browsers
D)Flash drives

Answer 1

D

Question 2

The primary form of data storage within a personal computer is:

A)The CD-ROM.
B)The hard disk drive.
C)A zip drive.
D)The recycle bin.

Answer 2

B

Question 3

What keeps track of the location of files and folders on the HDD?

A)The search engine
B)The HDD itself
C)The CPU
D)The FAT

Answer 3

D

Question 4

The ultimate goal of obtaining an image of a hard disk drive is to:

A)Locate as much incriminating information as possible.
B)Preserve the photographs and video stored on the drive.
C)Give priority to the text files on the drive.
D)Obtain information without altering the drive in any way.

Question 5

A software algorithm used to create a "fingerprint" of a file or an entire HDD is called:

A)MD5.
B)ROM.
C)RAM.
D)MAC OS.

Question 6

Which of the following is NOT considered a type of software?

A)Linux
B)Firefox
C)Excel
D)Random Access Memory

Question 7

A cluster is a group of ________ in multiples of ________.

A)Partitions, two
B)Disks, four
C)Cylinders, three
D)Sectors, two

Question 8

The boot (start-up)process for a computer is controlled by:

A)The hard disk drive.
B)ROM.
C)RAM.
D)USB thumb drives.

Question 9

Evidentiary data may be recovered from which of the following?

A)Slack space on the HDD
B)Unallocated space on the HDD
C)RAM swap files
D)All of the above

Question 10

One gigabyte can be expressed as:

A)1,000 bytes.
B)1,000 megabytes (MB).
C)1,000 kilobytes (KB).
D)8,000 bits.

Question 11

Which of the following is NOT associated with the partitioning of a HDD?

A)Quadrant
B)Sector
C)Track
D)Cluster

Question 12

Which is the best definition of latent data?

A)Anything readily available to the user, also known as visible data
B)Data that are hidden from view
C)An automatically saved copy of a file that was recently modified
D)Data which are typically of little use to forensic investigators

Question 13

Once a file is deleted by a user, it:

A)Is obliterated from the system and cannot be recovered.
B)Is retained until the disk space it occupies is allocated for another use.
C)May be identified using forensic image acquisition software.
D)Both B and C

Question 14

One of the most common places to begin to look for evidential data is in:

A)The spreadsheet files.
B)A photograph editing program.
C)A CAD package.
D)The word processing or text-based document files.

Question 15

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

A)Unplug every device from the CPU to preserve the hard disk drive.
B)Procure a warrant to search.
C)Remove the system to the laboratory for processing.
D)Document the scene.

Question 16

A motherboard:

A)Is the main circuit board within a computer.
B)Has a socket to accept RAM.
C)Connects to every device used by the system.
D)All of the above

Question 17

The term "bit" is short for:

A)Tidbit.
B)Byte.
C)Binary digit.
D)Database.

Question 18

When is it necessary to make a "fingerprint" of a HDD?

A)In most cases
B)Only sometimes
C)Before and after imaging its contents
D)Rarely

Question 19

Which of the following is NOT considered a hardware device?

A)Monitor
B)Hard disk drive
C)Mouse
D)Operating system

Question 20

A Network Interface Card (NIC)enables a personal computer to communicate with other computers via:

A)A wired connection.
B)A wireless connection.
C)A satellite connection.
D)Both A and B

Question 21

Which of the following actions taken at the crime scene involving a computer is incorrect?

A)Upon arrival, sketching the overall layout as well as photographing it
B)Photographing any running monitors
C)Removing the plug from the back of the computer, not from the wall
D)None of the above

Question 22

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

A)Internet "cookies"
B)Internet history
C)Cache
D)All of the above

Question 23

URL stands for:

A)Uniform Replacement Listing.
B)Unlimited Real-time Link.
C)Uniform Resource Locator.
D)User-Resource Link.

Question 24

Sectors are typically how many bytes in size?

A)126 bytes
B)256 bytes
C)512 bytes
D)1024 bytes

Question 25

One should not search for "visible" data in:

A)Swap files.
B)Temporary files.
C)Unallocated space.
D)Windows.

Question 26

If a file system defines a cluster as six sectors, how many bytes of information can be stored on each cluster?

A)24,576
B)512
C)3,072
D)307.2

Question 27

The best way to handle a mobile device and preserve data is:

A)Turn the mobile device off.
B)Leave the mobile device on.
C)Leave the mobile device on, but place it in a Faraday shield.
D)None of the above

Question 28

The two types of slack space are ________ slack and ________ slack.

A)File; RAM
B)RAM; ROM
C)Cluster; file
D)IP; TTI

Question 29

Unauthorized intrusion into a computer is called:

A)Crashing.
B)Whacking.
C)Hacking.
D)Spamming.

Question 30

In which of the following places would a computer forensic investigator look for latent data?

A)RAM slack
B)File slack
C)Unallocated space
D)All of the above

Question 31

Which of the following is NOT a type of RAM?

A)SSIM
B)DDIM
C)SD
D)DAB

Question 32

Which source will NOT be useful to investigators seeking to determine a user's Internet history?

A)Cookies
B)Cache
C)Favorite sites
D)Slack files

Question 33

Which of the following carries data from one hardware device to another?

A)System bus
B)Central processing unit (CPU)
C)Random-access memory (RAM)
D)Network interface card (NIC)

Question 34

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

A)RAM.
B)ROM.
C)System bus.
D)Central processing unit.

Question 35

Hard drive partitions are typically divided into:

A)Sectors.
B)Clusters.
C)Tracks.
D)All of the above

Question 36

Files containing chat and instant messaging are most likely stored in:

A)Swap files.
B)RAM.
C)ROM.
D)Slack files.

Question 37

Text messaging is also known as:

A)SMS.
B)MMS.
C)GPS.
D)RAM.

Question 38

One should not look for "latent" data in:

A)RAM slack.
B)File slack.
C)Unallocated space.
D)Temporary files.

Question 39

Most web browsers use a(n)________ to expedite and streamline browsing.

A)Area network
B)Cable modem
C)Domain
D)Caching system

Question 40

A(n)________ is placed on a hard disk drive by a website to track certain information about its visitors.

A)Phish
B)IP address
C)E-mail
D)Cookie

Question 41

The primary goal in obtaining data from a HDD is to do so without altering even one bit of data.

Question 42

A device that permits only requested traffic to enter a computer system is known as a(n):

A)Central processing unit (CPU).
B)Firewall.
C)Cookie.
D)Internet cache.

Question 43

Swap space is empty space on a hard disk drive (HDD)created because of the way the HDD stores files.

Question 44

A FAT tracks the location of files and folders on the hard disk drive.

Question 45

The two main types of evidentiary computer data are visible data and latent data.

Question 46

Which type of data are readily available to a computer user?

A)Swap
B)Latent
C)Visible
D)Allocated

Question 47

A bit, or a binary digit, is the smallest unit of information on a computer.

Question 48

The ________ is a complex network of wires that carry data from one hardware device to another.

A)Motherboard
B)Central processing unit (CPU)
C)Hard disk drive
D)Operating system

Question 49

Visible data exists in areas of the drive that are, generally speaking, unknown and inaccessible to most end users.

Question 50

A cluster is the smallest unit of data that a hard drive can address.

Question 51

The primary storage device on most computers is the hard disk drive (HDD).

Question 52

The central processing unit is the main system board of a computer that delivers power, data, and instructions to the computer's components.

Question 53

Before an OS can be formatted, it must write to a HDD.

Question 54

The central processing unit, or CPU, is the part of the computer that actually computes.

Question 55

The definition of software is:

A)Storage programs used to start the boot process.
B)A set of instructions compiled into a program that performs a particular task.
C)A complex network of wires that carry data from one hardware device to another.
D)A primary component of storage in the personal computer.

Question 56

RAM is not permanent; its contents are lost forever once power is taken away from the computer.

Question 57

A computer forensic investigator would most likely look for latent data in temporary files.

Question 58

Software comprises the physical components of the computer.

Question 59

ROM stores software programs and instructions while the computer is turned on.

Question 60

A domain manages traffic between computers on a network.

Question 61

________ space is a file or defined space on the HDD to which data is written to free RAM for applications that are in use.

Question 62

An IP address may lead to the identity of the person who was using a particular computer to access the Internet.

Question 63

Clusters are groups of ________.

Question 64

MMS, or Multimedia Message Service, is text messaging with attachments.

Question 65

The computer's ________ system is the bridge between the human user and the computer's electronic components.

Question 66

________ is a set of instructions compiled into a program that performs a particular task.

Question 67

Three places where a forensic computer examiner might look to determine what websites a computer user has visited recently are the Internet cache, cookies, and the Internet history.

Question 68

Investigators would want to copy blank or unused portions of the HDD to preserve ________ data.

Question 69

The operating systems of mobile devices are usually the same.

Question 70

Often mobile devices contain the same Internet artifacts as a computer, such as cookies and browser history.

Question 71

________ space is empty space on a hard disk drive (HDD)created because of the way the HDD stores files.

Question 72

The ________ is the main chip within the computer.

Question 73

________ consists of programs that are used to start the computer's boot process.

Question 74

A Message Digest 5 (MD5)/Secure Hash Algorithm (SHA)takes a ________ of a hard disk drive (HDD)before and after forensic imaging.

Question 75

An IP address typically takes the form ###.###.###.###, in which ### can be any number from 0 to 255.

Question 76

________ comprises the physical components of the computer.

Question 77

The call history for a mobile device is generally not able to be used in an investigation.

Question 78

Mobile devices are often shut off to avoid the loss of data.

Question 79

________ data includes all information that the operating system is presently aware of, and thus is readily accessible to the user.

Question 80

Extracting data from a mobile device is more complicated than extracting data from a computer.