Deck 19: Computer Forensics

Question 1

The ultimate goal of obtaining an image of a hard disk drive is to:

A) Locate as much incriminating information as possible.
B) Preserve the photographs and video stored on the drive.
C) Give priority to the text files on the drive.
D) Obtain information without altering the drive in any way.

Answer 1

D

Question 2

One of the most common places to begin to look for evidential data is in:

A) The spreadsheet files.
B) A photograph editing program.
C) A CAD package.
D) The word processing or text-based document files.

Answer 2

D

Question 3

One gigabyte can be expressed as:

A) 1,000 bytes.
B) 1,000 megabytes (MB).
C) 1,000 kilobytes (KB).
D) 8,000 bits.

Answer 3

B

Question 4

A cluster is a group of ________ in multiples of ________.

A) Partitions, two
B) Disks, four
C) Cylinders, three
D) Sectors, two

Question 5

A Network Interface Card (NIC)enables a personal computer to communicate with other computers via:

A) A wired connection.
B) A wireless connection.
C) A satellite connection.
D) Both A and B

Question 6

When is it necessary to make a "fingerprint" of a HDD?

A) In most cases
B) Only sometimes
C) Before and after imaging its contents
D) Rarely

Question 7

Which of the following is the best definition of latent data?

A) Anything readily available to the user, also known as visible data
B) Data that are hidden from view
C) An automatically saved copy of a file that was recently modified
D) Data which are typically of little use to forensic investigators

Question 8

The boot (start-up)process for a computer is controlled by:

A) The hard disk drive.
B) ROM.
C) RAM.
D) USB thumb drives.

Question 9

A software algorithm used to create a "fingerprint" of a file or an entire HDD is called:

A) MD5.
B) ROM.
C) RAM.
D) MAC OS.

Question 10

Which of the following is NOT classified as software?

A) Operating systems
B) Word processors
C) Web browsers
D) Floppy discs

Question 11

The first thing a crime scene investigator should do when encountering computer forensic evidence is:

A) Unplug every device from the CPU to preserve the hard disk drive.
B) Procure a warrant to search.
C) Remove the system to the laboratory for processing.
D) Document the scene.

Question 12

Which of the following is NOT considered a hardware device?

A) The monitor
B) The hard disk drive
C) The mouse
D) The operating system

Question 13

A motherboard:

A) Is the main circuit board within a computer.
B) Has a socket to accept RAM.
C) Connects to every device used by the system.
D) All of the above

Question 14

Evidentiary data may be recovered from which of the following?

A) Slack space on the HDD
B) Unallocated space on the HDD
C) RAM swap files
D) All of the above

Question 15

The term "bit" is short for:

A) Tidbit.
B) Byte.
C) Binary digit.
D) Database.

Question 16

The primary form of data storage within a personal computer is:

A) The CD-ROM.
B) The hard disk drive.
C) A zip drive.
D) The recycle bin.

Question 17

Once a file is deleted by a user,it:

A) Is obliterated from the system and cannot be recovered.
B) Is retained until the disk space it occupies is allocated for another use.
C) May be identified using forensic image acquisition software.
D) Both B and C

Question 18

Which of the following is NOT considered a type of software?

A) Linux
B) Firefox
C) Excel
D) Random Access Memory

Question 19

What keeps track of the location of files and folders on the HDD?

A) The search engine
B) The HDD itself
C) The CPU
D) The FAT

Question 20

Which of the following is NOT associated with the partitioning of a HDD?

A) Quadrant
B) Sector
C) Track
D) Cluster

Question 21

The best way to handle a mobile device and preserve data is:

A) Turn the mobile device off.
B) Leave the mobile device on.
C) Leave the mobile device on, but place it in a Faraday shield.
D) None of the above

Question 22

Unauthorized intrusion into a computer is called:

A) Crashing.
B) Whacking.
C) Hacking.
D) Spamming.

Question 23

One should not search for "visible" data in:

A) Swap files.
B) Temporary files.
C) Unallocated space.
D) Windows.

Question 24

Hard drive partitions are typically divided into:

A) Sectors.
B) Clusters.
C) Tracks.
D) All of the above

Question 25

Most web browsers use a(n)________ to expedite and streamline browsing.

A) Area network
B) Cable modem
C) Domain
D) Caching system

Question 26

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?

A) Internet "cookies"
B) Internet history
C) Cache
D) All of the above

Question 27

Files containing chat and instant messaging are most likely stored in:

A) Swap files.
B) RAM.
C) ROM.
D) Slack files.

Question 28

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:

A) RAM.
B) ROM.
C) System bus.
D) Central processing unit.

Question 29

URL stands for:

A) Uniform Replacement Listing.
B) Unlimited Real-time Link.
C) Uniform Resource Locator.
D) User-Resource Link.

Question 30

One should not look for "latent" data in:

A) RAM slack.
B) File slack.
C) Unallocated space.
D) Temporary files.

Question 31

Which of the following carries data from one hardware device to another?

A) System bus
B) Central processing unit (CPU)
C) Random-access memory (RAM)
D) Network interface card (NIC)

Question 32

In which of the following places would a computer forensic investigator look for latent data?

A) RAM slack
B) File slack
C) Unallocated space
D) All of the above

Question 33

Which source will NOT be useful to investigators seeking to determine a user's Internet history?

A) Cookies
B) Cache
C) Favorite sites
D) Slack files

Question 34

Text messaging is also known as:

A) SMS.
B) MMS.
C) GPS.
D) RAM.

Question 35

Which of the following is NOT a type of RAM?

A) SSIM
B) DDIM
C) SD
D) DAB

Question 36

If a file system defines a cluster as six sectors,how many bytes of information can be stored on each cluster?

A) 24,576
B) 512
C) 3,072
D) 307.2

Question 37

A directory or index cataloging the content of the Internet is called:

A) The World Wide Web.
B) A search engine.
C) A web browser.
D) An IPO.

Question 38

Which of the following are NOT considered to be classified as software?

A) Operating systems
B) Word processors
C) Web browsers
D) Floppy disks

Question 39

Sectors are typically how many bytes in size?

A) 126 bytes
B) 256 bytes
C) 512 bytes
D) 1024 bytes

Question 40

The most commonly used feature of the Internet is:

A) E-mail.
B) Academic research.
C) Online shopping.
D) Long-distance phone service.

Question 41

ROM stores software programs and instructions while the computer is turned on.

Question 42

A cluster is the smallest unit of data that a hard drive can address.

Question 43

A bit,or a binary digit,is the smallest unit of information on a computer.

Question 44

A(n)________ is placed on a hard disk drive by a website to track certain information about its visitors.

A) Phish
B) IP address
C) E-mail
D) Cookie

Question 45

The central processing unit,or CPU,is the part of the computer that actually computes.

Question 46

RAM is not permanent; its contents are lost forever once power is taken away from the computer.

Question 47

The central processing unit is the main system board of a computer that delivers power,data,and instructions to the computer's components.

Question 48

Which type of data are readily available to a computer user?

A) Swap
B) Latent
C) Visible
D) Allocated

Question 49

Which of the following actions taken at the crime scene involving a computer are incorrect?

A) Upon arrival, sketching the overall layout as well as photographing it
B) Photographing any running monitors
C) Removing the plug from the back of the computer, not from the wall
D) None of the above

Question 50

The two main types of evidentiary computer data are visible data and latent data.

Question 51

The definition of software is:

A) Storage programs used to start the boot process.
B) A set of instructions compiled into a program that performs a particular task.
C) A complex network of wires that carry data from one hardware device to another.
D) A primary component of storage in the personal computer.

Question 52

The two types of slack space are ________ slack and ________ slack.

A) File; RAM
B) RAM; ROM
C) Cluster; file
D) IP; TTI

Question 53

Software comprises the physical components of the computer.

Question 54

The ________ is a complex network of wires that carry data from one hardware device to another.

A) Motherboard
B) Central processing unit (CPU)
C) Hard disk drive
D) Operating system

Question 55

A FAT tracks the location of files and folders on the hard disk drive.

Question 56

Before an OS can be formatted,it must write to a HDD.

Question 57

Visible data exists in areas of the drive that are,generally speaking,unknown and inaccessible to most end users.

Question 58

A device that permits only requested traffic to enter a computer system is known as a(n):

A) Central processing unit (CPU).
B) Firewall.
C) Cookie.
D) Internet cache.

Question 59

The primary goal in obtaining data from a HDD is to do so without altering even one bit of data.

Question 60

The primary storage device on most computers is the hard disk drive (HDD).

Question 61

Often mobile devices contain the same Internet artifacts as a computer,such as cookies and browser history.

Question 62

Swap space is empty space on a hard disk drive (HDD)created because of the way the HDD stores files.

Question 63

The ________ is the main chip within the computer.

Question 64

Three places where a forensic computer examiner might look to determine what websites a computer user has visited recently are the Internet cache,cookies,and the Internet history.

Question 65

The computer's ________ system is the bridge between the human user and the computer's electronic components.

Question 66

A domain manages traffic between computers on a network.

Question 67

________ is a set of instructions compiled into a program that performs a particular task.

Question 68

The call history for a mobile device is generally not able to be used in an investigation.

Question 69

An IP address may lead to the identity of the person who was using a particular computer to access the Internet.

Question 70

MMS,or Multimedia Message Service,is text messaging with attachments.

Question 71

Clusters are groups of ________.

Question 72

A computer forensic investigator would most likely look for latent data in temporary files.

Question 73

A Message Digest 5 (MD5)/Secure Hash Algorithm (SHA)takes a ________ of a hard disk drive (HDD)before and after forensic imaging.

Question 74

Extracting data from a mobile device is more complicated than extracting data from a computer.

Question 75

The operating systems of mobile devices are usually the same.

Question 76

Mobile devices are often shut off to avoid the loss of data.

Question 77

Investigators would want to copy blank or unused portions of the HDD to preserve ________ data.

Question 78

________ consists of programs that are used to start the computer's boot process.

Question 79

An IP address typically takes the form ###.###.###.###,in which ### can be any number from 0 to 255.

Question 80

________ comprises the physical components of the computer.