Deck 1: Computer Forensics and Investigations As a Profession

Question 1

In a criminal or public case, if you have enough information to support a search warrant, the prosecuting attorney might direct you to submit a(n) ____.

A) blotter
B) exhibit report
C) litigation report
D) affidavit

Answer 1

D

Question 2

Based on the incident or crime, the complainant makes a(n) ____, an accusation or supposition of fact that a crime has been committed.

A) litigation
B) allegation
C) blotter
D) prosecution

Answer 2

B

Question 3

It's the investigator's responsibility to write the affidavit, which must include ____ (evidence) that support the allegation to justify the warrant.

A) litigation
B) prosecution
C) exhibits
D) reports

Answer 3

C

Question 4

The law of search and seizure protects the rights of all people, excluding people suspected of crimes.

Question 5

____ involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.

A) Data recovery
B) Network forensics
C) Computer forensics
D) Disaster recovery

Question 6

In the Pacific Northwest, ____ meets monthly to discuss problems that law enforcement and corporations face.

A) IACIS
B) CTIN
C) FTK
D) FLETC

Question 7

Computer investigations and forensics fall into the same category: public investigations.

Question 8

A(n) ____ is a person using a computer to perform routine tasks other than systems administration.

A) complainant
B) user banner
C) end user
D) investigator

Question 9

After a judge approves and signs a search warrant, it's ready to be executed, meaning you can collect evidence as defined by the warrant.

Question 10

The FBI ____ was formed in 1984 to handle the increasing number of cases involving digital evidence.

A) Federal Rules of Evidence (FRE)
B) Department of Defense Computer Forensics Laboratory (DCFL)
C) DIBS
D) Computer Analysis and Response Team (CART)

Question 11

The ____ group manages investigations and conducts forensic analysis of systems suspected of containing evidence related to an incident or a crime.

A) network intrusion detection
B) computer investigations
C) incident response
D) litigation

Question 12

In a ____ case, a suspect is tried for a criminal offense, such as burglary, murder, or molestation.

A) corporate
B) civil
C) criminal
D) fourth amendment

Question 13

____ involves preventing data loss by using backups, uninterruptible power supply (UPS) devices, and off-site monitoring.

A) Computer forensics
B) Data recovery
C) Disaster recovery
D) Network forensics

Question 14

By the 1970s, electronic crimes were increasing, especially in the financial sector.

Question 15

The affidavit must be ____ under sworn oath to verify that the information in the affidavit is true.

A) notarized
B) examined
C) recorded
D) challenged

Question 16

By the early 1990s, the ____ introduced training on software for forensics investigations.

A) IACIS
B) FLETC
C) CERT
D) DDBIA

Question 17

Published company policies provide a(n) ____ for a business to conduct internal investigations.

A) litigation path
B) allegation resource
C) line of allegation
D) line of authority

Question 18

A ____ usually appears when a computer starts or connects to the company intranet, network, or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer systems and network traffic at will.

A) warning banner
B) right of privacy
C) line of authority
D) right banner

Question 19

In general, a criminal case follows three stages: the complaint, the investigation, and the ____.

A) litigation
B) allegation
C) blotter
D) prosecution

Question 20

To be a successful computer forensics investigator, you must be familiar with more than one computing platform.

Question 21

In addition to warning banners that state a company's rights of computer ownership, businesses should specify a(n) ____ who has the power to conduct investigations.

A) authorized requester
B) authority of line
C) line of right
D) authority of right

Question 22

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
allows legal counsel to use previous cases similar to the current one because the laws don't yet exist

Question 23

Maintaining ____ means you must form and sustain unbiased opinions of your cases.

A) confidentiality
B) objectivity
C) integrity
D) credibility

Question 24

The ____________________ provides a record of clues to crimes that have been committed previously.

Question 25

The ____________________ to the U.S. Constitution (and each state's constitution) protects everyone's rights to be secure in their person, residence, and property from search and seizure.

Question 26

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
recognizes file types and retrieves lost or deleted files

Question 27

Corporations often follow the ____ doctrine, which is what happens when a civilian or corporate investigative agent delivers evidence to a law enforcement officer.

A) silver-tree
B) gold-tree
C) silver-platter
D) gold-platter

Question 28

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
sworn statement of support of facts about or evidence of a crime that is submitted to a judge to request a search warrant before seizing evidence

Question 29

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
specifies who has the legal right to initiate an investigation, who can take possession of evidence, and who can have access to evidence

Question 30

Without a warning banner, employees might have an assumed ____ when using a company's computer systems and network accesses.

A) line of authority
B) right of privacy
C) line of privacy
D) line of right

Question 31

Most computer investigations in the private sector involve ____.

A) e-mail abuse
B) misuse of computing assets
C) Internet abuse
D) VPN abuse

Question 32

When you work in the ____________________ group, you test and verify the integrity of standalone workstations and network servers.

Question 33

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
yields information about how a perpetrator or an attacker gained access to a network

Question 34

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
investigates data that can be retrieved from a computer's hard disk or other storage media

Question 35

____________________ involves obtaining and analyzing digital information for use as evidence in civil, criminal, or administrative cases.

Question 36

The term ____________________ refers to large corporate computing systems that might include disparate or formerly independent systems.

Question 37

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
organization that exchanges information about techniques related to computer investigations and security

Question 38

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
the legal process of proving guilt or innocence in court

Question 39

Your ____ as a computer investigation and forensics analyst is critical because it determines your credibility.

A) professional policy
B) oath
C) line of authority
D) professional conduct

Question 40

Match each item with a statement below:
a.Computer forensics
f.HTCIA
b.Network forensics
g.Affidavit
c.Litigation
h.Industrial espionage
d.Xtree Gold
i.Line of authority
e.Case law
involves selling sensitive or confidential company information to a competitor

Question 41

What text can be used in internal warning banners?

Question 42

Briefly describe corporate sabotage.

Question 43

Briefly describe the main characteristics of public investigations.

Question 44

Briefly describe the triad that makes up computer security.

Question 45

What questions should an investigator ask to determine whether a computer crime was committed?

Question 46

What is embezzlement?

Question 47

What are the three levels of law enforcement expertise established by CTIN?

Question 48

Briefly describe the main characteristics of private investigations.

Question 49

What are some of the most common types of corporate computer crime?

Question 50

Mention examples of groups that should have direct authority to request computer investigations in the corporate environment.