Deck 10: Computer Forensics: Terminology and Requirements

Question 1

What are the two types of data extraction?

A) physical and logical
B) manual and automated
C) internal and external
D) accidental and intentional

Answer 1

A

Question 2

Which lab system is capable of handling larger workloads simultaneously?

A) Better Lab System
B) Dream Lab System
C) Power Lab System
D) Basic Lab System

Answer 2

C

Question 3

Computer forensics helps which of the following groups in supporting claims of wrongful termination, sexual harassment, and age discrimination?

A) individuals
B) civil litigators
C) corporations
D) prosecutors

Answer 3

A

Question 4

ASCII code for defining characters is based on ________ code.

A) hexadecimal
B) binary
C) RAM
D) sector

Question 5

In which system are interpretative rules associated with a base of two with integers represented by zeroes and ones?

A) binary system
B) basic input/output system
C) hexadecimal system
D) encrypting file system

Question 6

What kind of programs should investigators employ to reveal hidden and deleted files, unlock encrypted files, and detect steganography?

A) both internal and external programs
B) only licensed programs
C) both manual and automated programs
D) only contemporary programs

Question 7

Which of the following programs reads disks a track at a time and calculates an algorithmic signature represented by unique file identifiers?

A) recovery
B) forensic
C) verification
D) imaging

Question 8

Which of the following is NOT true of computer forensic science?

A) It protects digital evidence from possible alterations.
B) It provides mechanisms for evidence duplication.
C) It encourages allegations of corruption on the part of investigators.
D) It enables the creation of forensically sound images useful for data analysis.

Question 9

Which of the following is NOT an advantage attributed to the introduction of disk operating systems?

A) It provides for the storage of documents in contiguous sectors.
B) It reduces the data management burden of applications.
C) It allows application-specific disk hierarchies.
D) It maximizes the use of limited space.

Question 10

Which of the following is NOT a traditional problem in computer investigations?

A) inadequate resources
B) lack of mechanisms for interpreting and relaying highly technical information
C) lack of communication and cooperation among agencies
D) evidence corruption

Question 11

Which of the following is an example of a disk recovery and extraction tool?

A) Tech Assist's ByteBack
B) Norton Utilities
C) Access Data's Forensic Toolkit
D) Ultimate Toolkit

Question 12

Which of the following can be attributed to the demand for a centralized disk operating system and the birth of DOS?

A) increased responsibilities among local police agencies
B) increased interest in emerging technology
C) increased consumer choice and market competition
D) increased concern for security of data

Question 13

Which of the following is NOT a step included in the logical extraction of data?

A) data reduction through comparison
B) extraction of file slack
C) recovery of deleted files
D) evaluation of the partition table

Question 14

Which of the following refers to the area of a computer that holds data during processing and is erased when power is shut down?

A) static memory
B) primary storage
C) volatile memory
D) secondary storage

Question 15

Which of the following are the three primary components of a computer?

A) hardware, firmware, operating systems
B) firmware, hardware, software
C) software, hardware, operating systems
D) firmware, software, Maresware

Question 16

Which of the following factors is most important in determining the type of tool to be used in a computer forensics investigation?

A) type of crime encountered
B) type of information
C) type of concealment
D) type of suspect device

Question 17

Which of the following is a single circular disk with concentric tracks that are turned by spindles under one or more heads?

A) logical drive
B) sector
C) fixed disk
D) floppy disk

Question 18

Which of the following is true of a hexadecimal system?

A) Interpretative rules are associated with a base of two with integers represented by zeroes and ones.
B) Interpretative rules are associated with a base of 16 with integers ranging from 0 to 9 and A to F.
C) The range of whole numbers that can be represented by a single byte is 0 to 255.
D) Investigators do not need to evaluate files with a hexadecimal viewer.

Question 19

A(n) ________FAT is used if a disk requires less than 65,536 but more than 4,096 clusters.

A) 4-bit
B) 16-bit
C) 8-bit
D) 32-bit

Question 20

The development and regular review of which of the following is essential as technology changes?

A) cyclical redundancy checksum
B) master boot record
C) standard operating procedures
D) cipher combination locks

Question 21

The BIOS is stored in the Encrypting File System (EFS).

Question 22

File systems allow end-users to perceive their document as multiple streams of bytes while providing for its storage in contiguous sectors.

Question 23

Which of the following tools are the most popular and stand-alone imaging utilities employed for forensic investigators?

A) EnCase and FastBloc
B) ByteBack and Safeback
C) DECLASFY and BRANDIT
D) Data Dumper and Grep

Question 24

Extraction of a file pertinent to an examination may be based on the file name and extension, file header, file content, and location on the drive.

Question 25

Which of the following programs extends decryption capabilities beyond a single computer by using the distributed power of multiple computers across a network to decrypt files and recover passwords?

A) Password Recovery Toolkit
B) FTK Imager
C) Distributed Network Attack
D) Registry Viewer

Question 26

Forensic imaging programs must be capable of making a bitstream duplicate or an image of an original disk or partition onto fixed or removable media.

Question 27

The physical extraction phase identifies and recovers files and data based on the installed operating system, file system, and/or application.

Question 28

The logical file size refers to the exact size of a file in bytes.

Question 29

Many agencies do not avail themselves of the free training courses provided by the FBI and the Federal Law Enforcement Training Center as the agencies are unable to afford the loss of personnel.

Question 30

The cluster size for a particular device is specified in which of the following?

A) master boot record
B) read-only memory
C) BIOS parameter block
D) file allocation table

Question 31

The statement of compliance or noncompliance with certain specifications or other requirements must be included in a report.

Question 32

A file system is the combination of a hardware device and computer instructions and data that reside as read-only software on that device.

Question 33

The smallest forms of data storage are represented by binary digits.

Question 34

Overt files are not hidden, deleted, or encrypted.

Question 35

Raw image files increase the costs associated with the maintenance of forensic laboratories and software libraries because they exhibit backward compatibility issues.

Question 36

Electronic data recovery should be reserved for instances when the instrumentality of computer technology has been demonstrated.

Question 37

Most contemporary integrated packages have stand-alone imaging programs.

Question 38

During analysis of digital evidence, which of the following elements is addressed?

A) password crackers
B) truncated entries
C) case number
D) actus reus

Question 39

A file system is the disk management platform employed by a particular operating system.

Question 40

Which of the following terms refers to a suspect's guilty mind or intent, as might be demonstrated by the use of data hiding or drive wiping techniques?

A) mens rea
B) harm
C) actus reus
D) ownership

Question 41

The ________ determines the size of the appropriate FAT based on the number of clusters necessary to represent the entire disk space.

Question 42

What is the first step in the development of computer forensic capabilities? Describe the minimum hardware requirements for a dream field system.

Question 43

________ is the fear of new technology.

Question 44

________ are devices and data at the electronic or machine level.

Question 45

The familiarity and utilization of ________ may result in a situation where investigators know just enough to make them potentially hazardous to the investigation.

Question 46

Microsoft's ________ provides more security and is more efficient in terms of utilization of storage space than FAT.

Question 47

Forensic laboratories should be equipped with ________ so that criminal contraband can be permanently removed from suspect machines.

Question 48

Evaluation of the ________ and unused space on the physical drive may identify the file systems present and determine if the entire physical size of the hard disk is accounted for.

Question 49

The use of ________ may force agencies to update software licenses or lose company support.

Question 50

________ enable investigators to perfectly duplicate a suspect drive onto a form of removable media.

Question 51

The advent of ________ required a corresponding mechanism to ensure that applications did not interfere with one another's data storage.

Question 52

________ can be used to identify and eliminate known files through the comparison of calculated hash values to authenticated hash values.

Question 53

A ________ is the number of bytes that represent about one-half page of text.

Question 54

Computer forensics helps ________ in pre-search warrant preparations and post-seizure handling of computer equipment.

Question 55

Explain how over-reliance on automated programs and self-proclaimed experts pose a problem in computer investigations.How can this problem be overcome?

Question 56

Define firmware.Describe the boot up sequence of a computer with particular reference to the BIOS found in IBM-compatible personal computers.

Question 57

Traditionally, suspect drivers and disks were copied at the ________ level.

Question 58

________ allow front-page viewing of multiple files, thus enabling investigators to quickly identify questionable graphics files.

Question 59

Discuss the development within mobile device forensic tools and suggest issues that need to be addressed to improve them.

Question 60

Describe the five general categories of data analysis tools.Illustrate with an example how file viewer software is used in child pornography cases.