Deck 4: Policies and Procedures

Question 1

In order to protect a cellular phone for evidentiary procedures,transport it in a(n)___________.

Answer 1

Faraday bag

Question 2

Which of the following is NOT an item generally included in a forensic kit?

A)Flashlight
B)USB external drive
C)General case intake form
D)Latex gloves

Answer 2

C

Question 3

?Which of the following is one of the bottom-layer examinations you would make on a suspect computer?

A)Extraction of encrypted files
B)Operating system norms
C)Extraction of unallocated space files of interest
D)All of the above

Answer 3

B

Question 4

What is considered to be the best way to preserve the layout of a crime scene?

A)Write down all information.
B)Use a compact cassette recorder.
C)Ask questions.
D)Photograph it.

Question 5

Include a(n)________ as part of your forensic equipment because it allows you to carry a library of forensic tools and can give you access to the Internet.

Question 6

A(n)________ needs to be completed when reviewing a potential case and determining whether to accept it.

Question 7

Common criteria for accepting a case include all of the following EXCEPT

A)Whether it is a criminal or civil case
B)The law enforcement agency in charge of the case
C)The potential impact upon the organization
D)Liability issues

Question 8

When should the process of documenting e-evidence begin?

A)Upon receipt of the evidence
B)While gathering evidence
C)While forensically investigating the evidence
D)Upon first receiving the call concerning the case

Question 9

Which of the following is NOT one of the areas to be considered when selecting members of a forensic unit?

A)Experience
B)Team player
C)Mental agility
D)Works well under pressure

Question 10

You should ask questions about what types of ________ and ________ are involved because you can save time and mistakes if you take the correct equipment with you.

Question 11

Who has the legal authority to conduct a search in a criminal case?

A)It's decided by the local jurisdiction.
B)It's decided by federal statutes.
C)It's decided by the investigator on site.
D)It's decided by the lead detective on the scene.

Question 12

?The primary consideration in determining where to do the forensic work is always the

A)Estimation of personnel needed
B)Integrity of the evidence
C)Impact of the investigation on the organization
D)Current number of cases being handled

Question 13

Forensic investigators establish generally accepted policies and procedures to ensure that

A)They can bill at the correct rate
B)Technical procedures are well documented
C)All cases will go to trial
D)Both B and C

Question 14

Which of the following would NOT be part of a standard report?

A)Brief summary
B)Body of the report
C)Brief biography of the suspect
D)Conclusion section

Question 15

If you encounter files that have been password protected,one option is to

A)Ask the user to give you the password
B)Reconfigure the BIOS to allow access to the file
C)Try a number of standard passwords to try to find a match
D)Consult a hacker site for help with the password

Question 16

If you find recent files of a particular application but the application itself is not present on the computer,what can you infer?

A)The computer user is not very experienced.
B)The application file belongs on another computer.
C)The application program has been recently installed.
D)The application program is stored on some other storage device.

Question 17

Why is tagging books and magazines at a crime scene considered important?

A)You might wish to subscribe to a few yourself.
B)It isn't important.
C)It allows the investigator to get to know how the person thinks.
D)You might find passwords hidden in the articles.

Question 18

The system BIOS can tell you

A)Hard drive geometry settings
B)What Web sites the user has visited recently
C)The computer's operating system
D)What applications are installed on the computer

Question 19

Training of forensic personnel might include which of the following?

A)Psychological profiling
B)Medical forensics
C)Ballistics
D)iPOD data retrieval

Question 20

The ________ allows police to seize evidence if they see it while lawfully engaged in searching for other evidence.

Question 21

A(n)________ examination is where most of the computer forensic work is performed.

Question 22

The ________ determines which of the computer's media is used to start the computer.

Question 23

Your best bet for decrypting a file is to find out what program was used to encrypt it and obtain the ________ for that software.

Question 24

The ________ of a report contains as much detail and documentation as you can include.

Question 25

The computer's time and date should be compared against a known standard,such as ________.

Question 26

The main reason for file compression is to ________.

Question 27

The ________ of the extraction model is primarily concerned with developing a picture of how the system is set up.

Question 28

A(n)________ examination involves searches of the areas the operating system does not recognize as being normally used.

Question 29

You can use ________ analysis to eliminate common files by comparing them to the same files on your system.

Question 30

With the original evidence safely stored,you should make a(n)________ of the forensic image.