CyberCrimes CH 1-14

Mahmood is examining a device for digital evidence. There are two types of evidence he is looking for. Which type of evidence will prove that his client is not guilty?

Inculpatory evidence

Exculpatory evidence

Miaculpatory evidence

Discretionary evidence

Exculpatory evidence

(Correct Answer)

Rationale:

Mahmood is looking for exculpatory evidence which is evidence that tends to show that a defendant is not guilty of the crime they have been charged with. This type of evidence can help to exonerate or clear the defendant of the charges. Exculpatory evidence can include physical evidence, witness statements, or other types of evidence that support the defendant's innocence.

When conducting a computer investigation for potential criminal violations of the law, the legal processes you follow depend on local customs, legislative standards, and rules of evidence. In general, however, a criminal case follows three stages. What are those three stages?

Complaint, the investigation, and the prosecution

Complaint, discovery, and the trial

Complaint, service of process, and motions

Complaint, answer, discovery, and trial

Complaint, the investigation, and the prosecution

(Correct Answer)

Rationale:

If it has been determined that a crime has been committed, it is sent to the prosecutor to prosecute the case. Hence, there is a complaint, an investigation, and then the prosecution.

Allen works for a small newspaper. There is no corporate security investigations group, no written or verbal acceptable use policy, and the publisher (owner) owns the rights to all the computer hardware and software. One day, the publisher calls him into the office and asks him to help them with an email problem. Upon fixing the problem Allen discovers that there are illicit photos (no one was underage) on the publisher's laptop. The publisher later asks Allen to sanitize the laptop because the publisher wants to give it to their grandson. Allen must go through the laptop to find all the photos. What can Allen do to stop this work behavior?

Report the publisher to Human Resources

File a hostile work environment claim

Sanitize the laptop and do nothing else

Refuse to do the job

File a hostile work environment claim

(Correct Answer)

Rationale:

In this situation, no laws are broken. There is no written or verbal acceptable use policy so there is no legal recourse for the publisher's actions other than Allen filing a claim citing a hostile work environment.

Thanks to the dark web, anybody can access computer programs that will help users exfiltrate (remove) data from any type of computer or network. Because of this activity, white-collar crime and industrial espionage are on the rise. How does white-collar-crime compare to industrial espionage?

White-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

Espionage refers to financial crimes committed in a business or professional setting, while white collar crime refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

White-collar crime is the same as espionage and are both punishable offenses.

White-collar crime and espionage are victimless crimes.

White-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity. (Correct Answer)

Rationale:

The cost of white-collar crime and espionage to companies can vary greatly and is difficult to quantify with precision. However, the fiscal impact can be substantial and goes far beyond financial losses. However, in general white-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

Kwan is a Digital Evidence Specialist and is looking for a new job. He has an immaculate resume, fantastic references, and an excellent work history. But on the weekends, he likes to go out and get drunk, play beer pong, get high, and to post a lot of selfies to his social media sites. Recently, he applied to Jaffe Corporation for a Digital Evidence Specialist position. The interview went well. In fact, Jaffe is looking to hire him for a project, but upon further investigation, they decide not to. What might the deciding factor have been in Jaffe Corp. not hiring Kwan?

Kwan should put all his social media platform settings on private so no one can see his pictures.

Kwan can do whatever he wants. What he does with his own time should not affect him professionally.

Kwan's selfies of getting drunk and high show a critical lack of judgment. Those images could allow an opposing attorney to discredit him due to his behavior. (Correct Answer)

Kwan can control what pictures of him are put on the Internet.

Rationale:

In today's world, getting drunk or high may not be illegal, but when working in the legal field, flaunting it shows a lack of character and judgment. Doing so could allow an opposing attorney to discredit Kwan for his behavior. Any image that represents Kwan can be used against him professionally. Kwan cannot control what pictures of him end up on the Internet; he can only control his behavior.

Lucy needs to make a forensic initial assessment about a case she is investigating. What are some of the steps she needs to take for the assessment?

Has law enforcement apprehended a suspect?

Have law enforcement or company security officers already seized the computer, disks, peripherals, and other components?

Was a computer or a laptop found?

Is the president of the company available?

Have law enforcement or company security officers already seized the computer, disks, peripherals, and other components? (Correct Answer)

Rationale:

Lucy needs to identify, preserve, and analyze digital evidence that may be relevant to an investigation. So it is important that she knows if computers, disks, peripherals, and other components have been seized, and if they are safely within the chain-of-custody. Then, Lucy can begin her investigation.

Carmon needs to determine what the preliminary approach to a case should be. What are some of the general steps she needs to follow to investigate the case?

Create a detailed check list, determine resources you need, obtain, and copy an evidence drive

Check fingerprint databases, search rainbow tables, speak with police personnel

Identify suspects, check the DMV, talk to crime scene investigators for evidence that might have been missed

Identify the risks, mitigate, or minimize the risks, test the design, investigate the data recovered

Create a detailed check list, determine resources you need, obtain, and copy an evidence drive

Identify the risks, mitigate, or minimize the risks, test the design, investigate the data recovered

(Correct Answers)

Rationale:

Carmon's approach to the case should be to; determine the resources she needs, obtain, and copy the evidence drive, identify the risks, mitigate or minimize the risks, test the design, analyze and recover the digital evidence, investigate the data she recovers, complete the case report, and critique the case.

Rationale:

Carmon's approach to the case should be to; determine the resources she needs, obtain, and copy the evidence drive, identify the risks, mitigate or minimize the risks, test the design, analyze and recover the digital evidence, investigate the data she recovers, complete the case report, and critique the case.

Joe has been tasked with investigating an incident at Zander Corp. What is the first rule he must follow that is important for all investigations, no matter how big or small?

Categorizing the evidence

Stabilizing the evidence

Preserve the evidence

Detain the evidence

Preserve the evidence (Correct Answer)

Rationale:

Joe must preserve the evidence. This is the first rule for all investigations. It refers to the overall process of collecting, documenting, and maintaining evidence so that it can be used as evidence in a legal proceeding or investigation.

Jennifer is about to take over a computer crime case at Amcore lab. Before she begins, must verify that the chain of custody has not been broken. She discovers that the seal on the container on the suspect's hard drive has been broken and there is no signature on the sign out sheet that someone took the hard drive for analysis. How does this affect the chain of custody?

It does nothing to the chain of custody.

It only affects authenticity.

It breaks the chain of custody.

The custody of the data's journey is now refutable but can still be admissible.

It breaks the chain of custody. (Correct Answer)

Rationale:

The chain of custody has been broken. It is not known if the data on the hard drive has been corrupted or manipulated. Multiple hard drives located in the same facility could be called into question because an attorney could hypothesize that those hard drives have also been corrupted or manipulated.

Akikta has been given a Windows 10 computer that needs to be investigated. Mostly, he will be recovering deleted files, and checking unallocated space on the hard drive. What are some software Akikta may want to use?

FTK Imager, X-Ways Forensics, and dd

EnCase, FTK, and Autopsy

Photorec and Scalpel

md5sum and sha256sum

EnCase, FTK, and Autopsy

Photorec and Scalpel

(Correct Answers)

Rationale:

Akika would use EnCase, FTK, and Autopsy to recover deleted files and Photorec and Scalpel, which are file carving tools, to look for unallocated space on the hard drive.

Kailani is about to take possession of a Windows 2000 computer for forensic investigation. Why must Kailani use older forensic tools for this Windows 2000 computer?

Windows 2000 is too advanced

Windows 2000 is a legacy system

Windows 2000 is no longer used in production networks

Windows 2000 no longer works

Windows 2000 is a legacy system

(Correct Answer)

Rationale:

Windows 2000 is a legacy system and is still used in some instances. Not all modern tools will work with it. However, tools like ForensiX and SMART are still available for use with Windows 2000 for data acquisition.

Ethel is transporting a computer to her forensic lab, and she needs to secure the device before transport. What does Ethel need to do to ensure that the computer maintains chain of custody and arrives intact at her lab?

Put the entire tower or laptop in a Faraday box or bag

Transport the drives in separate vehicles from the tower or laptop

Place evidence tape over drive bays and insertion slots for power supply cords and USB cables

Place everything in her trunk and lock it so it can't be stolen

Place evidence tape over drive bays and insertion slots for power supply cords and USB cables

Place everything in her trunk and lock it so it can't be stolen

(Correct Answers)

Rationale:

To transport the computer to her forensics lab, Ethel must seal off the device by placing evidence tape over drive bays and plug insertion slots as well as write her name on the evidence tape sealing the device. If the tape is removed or broken, so is her name, meaning the seal has been broken.

Rationale:

To transport the computer to her forensics lab, Ethel must seal off the device by placing evidence tape over drive bays and plug insertion slots as well as write her name on the evidence tape sealing the device. If the tape is removed or broken, so is her name, meaning the seal has been broken.

Haris is presented with a case by a client involving employee termination. He hasn't been told about the case yet, but he can guess. What are some of the predominate types of issues that occur in an employee termination case?

Working from home

Creating a hostile work environment

Playing games

Surfing the Internet

Creating a hostile work environment

(Correct Answer)

Rationale:

Haris knows that most often the usual types of employee termination cases involve abuse of company resources such as sending inappropriate emails, creating a hostile work environment, and using company resources to start a business on the side.

Fumiko will be conducting an investigation involving Internet abuse on a client's internal private network. What will he need to gather from his client's network administrator?

The suspect's computer IP address

The client's ISP IP address

The client's router IP address

The organization's Internet proxy server logs

The suspect's computer IP address

The organization's Internet proxy server logs

(Correct Answers)

Rationale:

Fumiko will need to get the organization's Internet proxy server logs and the suspect's computer IP address to track where the suspect's computer has been going on the Internet.

Rationale:

Fumiko will need to get the organization's Internet proxy server logs and the suspect's computer IP address to track where the suspect's computer has been going on the Internet.

During an investigation, Jerry discovers that there were no matches between the network server logs and the forensic examination showing no contributing evidence that a crime was committed. What does this mean for the investigation?

The allegations were unsubstantiated and there was no misconduct

The allegations were substantiated and there was misconduct

There were no allegations, just conjecture

It was all a misunderstanding

The allegations were unsubstantiated and there was no misconduct (Correct Answer)

Rationale:

Because there were no matches between the logs and no contributing forensic evidence was found, Jerry was able to say that there was no misconduct on the part of the employee.

Quan-Van is working on a case that's attorney-client privilege (ACP). The attorney asks that all correspondence with them be verbal. What is the reason behind this request?

The attorney doesn't like to read

There will be too much paperwork

Anything written down is subject to discovery

Anything written down must be done in a very specific way

Anything written down is subject to discovery

(Correct Answer)

Rationale:

Quan-Van has been told that once he is signed on to the case, anything written down is subject to discovery by the opposing counsel. Therefore, until the preliminary report is needed, the attorney doesn't want anything in writing.

Olga is about to embark on her first overseas Internet abuse case. She knows the privacy laws of her state as she has worked on Internet abuse cases on a regular basis. The client she is working for is in Germany so she can easily perform the investigation the same way in Germany as she does in the United States.

True

False

False (Correct Answer)

Rationale:

Olga cannot investigate as easily in Germany as she does in the United States because the laws covering data privacy are much stricter in the European Union than they are in the United States. Investigating a network server log without proper authorization might not be legal in Germany due to the General Data Protection Regulation (GDPR), which is the standard for data protections and privacy in the European Union (EU), and is more stringent than U.S. privacy laws

Dakarai has many legacy operating systems on his forensic workstation as well as the newest OSs, but he has only the most up-to-date software on his day-to-day workstation. Why does Dakarai need legacy operating systems?

It's not taking up much space on his forensic station, so why bother?

It's cheaper to keep the older software around.

Dakarai hasn't gotten around to getting rid of the old software yet.

Older computer systems may not be compatible with modern software.

Older computer systems may not be compatible with modern software. (Correct Answer)

Rationale:

Dakarai keeps legacy operating systems because they allow older computer systems to be analyzed while preserving the data and metadata.

Rivka is building a forensic workstation and needs to buy some hardware to get started. What are some of the types of hardware she will need to buy?

A workstation running Windows 7

A write-blocker device, spare PATA and SATA ports

Network interface card (NIC)

Graphics card

A write-blocker device, spare PATA and SATA ports

Network interface card (NIC)

(Correct Answers)

Rationale:

Rivkas workstation must be running at least Windows 10 not 7. She will need a write-block device, spare PATA and SATA ports and a NIC. No additional graphics capabilities beyond what is standard on modern computers will be necessary.

Rationale:

Rivkas workstation must be running at least Windows 10 not 7. She will need a write-block device, spare PATA and SATA ports and a NIC. No additional graphics capabilities beyond what is standard on modern computers will be necessary.

Kevin is about to begin an examination of a hard drive. Out of all the tools available to him, which one is the most important to keep the OS from writing data to the hard drive?

SCSI card

Network interface card (NIC)

Write-blocker

Target drive

Write-blocker (Correct Answer)

Rationale:

Kevin will need a write-blocker to keep the hard drive from being written to by the OS. Network interface cards, SCSI cards and target drives do not write to the hard drive.

Gerald is using MS-DOS 6.22 to examine a legacy hard drive. Why would Gerald use such an old operating system?

Other DOS OSs are no longer available.

Other DOS OSs do not have the appropriate tools.

It's the only DOS OS that works with older digital forensic tools.

It is the only DOS OS that's least intrusive to disks.

It is the only DOS OS that's least intrusive to disks.

(Correct Answer)

Rationale:

Gerald uses MS-DOS 6.22 because it is the least intrusive as far as changing data. Older DOS versions are still available and they work with older digital forensics tools, but MS-DOS 6.22 is still the best for digital forensics work.

Isabella is conducting an investigation for a client. She will need to copy evidence from a disk using multiple methods. Why can't she use just one method?

It's just for backup purposes.

No one media type can be trusted.

No single method retrieves all data from a disk.

Analyzing data is a tricky job.

No single method retrieves all data from a disk.

(Correct Answer)

Rationale:

Isabella must start by copying the evidence, using a variety of methods because not one tool can retrieve all data on a disk well. She needs multiple tools to analyze all the data properly.

Sammy needs to return to the office to retrieve some antistatic bags and wrist straps before handling digital evidence. Why are these items important for handling digital evidence?

Static electricity doesn't do anything to digital evidence. It's just a precaution.

Static electricity can hurt the user.

Static electricity can make your hair stand up.

Static electricity can destroy digital evidence.

Static electricity can destroy digital evidence.

(Correct Answer)

Rationale:

Sammy knows that static electricity can cause physical damage to digital evidence, such as computers, hard drives, and memory chips, by electrostatic discharge (ESD). That is why it is important to have antistatic bags and wrist straps. They help avoid the build up of static electricity that causes ESD.

Kenneth is creating a bit-stream image from a bit-stream copy of an evidence drive, but he's confused as to what the difference is. To Kenneth, there isn't much difference. Please help him out and tell him what makes a bit-stream image different from a bit-stream copy.

A bit-stream image and a bit-copy are identical.

A bit-stream image replicates the evidence drive but is not an exact copy.

There only has to be one bit-stream copy made when working on an image drive.

A bit-stream image creates an exact copy of the evidence disk down to the physical drive level.

A bit-stream image creates an exact copy of the evidence disk down to the physical drive level.

(Correct Answer)

Rationale:

Kenneth is creating a bit-stream image. The difference between a bit stream-image and a bit-stream copy is that the image is an exact copy of the data down to the physical (target drive) being the same make and model of the evidence drive. Whereas the bit-copy is just a copy of the evidence drive but not on the same make and model of the actual drive (target drive).

Stella just finished writing a report for Tera Corp. and reviews her report one more time to check the steps she took to be sure her findings are repeatable. The problem is she used a new tool in her findings that has not been vetted by industry experts yet, so it may not adhere to industry standards. Why is this an issue?

New tools that are not vetted may not return repeatable data.

It doesn't change anything.

New tools are used all the time.

It's not important to repeat results.

New tools that are not vetted may not return repeatable data.

(Correct Answer)

Rationale:

Stella used a new tool that hasn't been vetted by industry experts and therefore may not adhere to industry standards. This issue will bring Stella's conclusions into question and may cause opposing counsel to try and throw out the case.

Daubert v. Merrell Dow Pharmaceuticals rules that the "testimony must be based off facts or data, whereas using Frye v. United States rules, the "testimony" must be based on generally accepted principles in the field in which it belongs.

True

False

True (Correct Answer)

Rationale:

Daubert v. Merrell Dow Pharmaceuticals rules that the "testimony must be based off facts or data, whereas using Frye v. United States rules, the "testimony" must be based on generally accepted principles in the field in which it belongs.

Each state has its own rules of civil procedure, which may be less stringent than federal rules but can never be more so.

True

False

False (Correct Answer)

Rationale:

Each state has its own rules of civil procedure, which may be MORE stringent than the federal rules but can never be LESS so.

Feng Mian is going to be a lay witness in Zepher Inc. v. United States. This will be the first time Feng Mian testifies. What is the purpose of a lay witness's testimony?

Testifies to evidence in the case

Testifies to personally observed facts

Testifies to evidence for a search warrant

Testifies to an accounting report

Testifies to personally observed facts

(Correct Answer)

Rationale:

Since Feng Mian is a lay witness, she will testify with first-hand knowledge of an event she witnessed that is relevant to the case.

Maddox is an expert in exfiltration (removal) of data. He is testifying about an incident where Areon Corp. lost its customer database to hackers over several months. He has no personal knowledge of the incident but has been called to testify before a jury. In what manner is Maddox allowed to testify?

He may testify as if he has personal knowledge of the event.

He can state his opinions by responding to actual questions.

He must state opinions by responding to hypothetical questions.

He should testify only about what he knows.

He can state his opinions by responding to actual questions.

(Correct Answer)

Rationale:

Maddox doesn't have personal knowledge about the specific occurrence (data exfiltration), so he must state his opinion by responding to hypothetical questions from the attorney that are based on available factual evidence.

Emilia is in the process of writing a preliminary report for the first time. Her friend Amari tells her to be careful as to what to write because a preliminary report is a high-risk document. What makes a preliminary report a high-risk document?

It's a final report.

Opposing counsel can try and discredit you with it.

The preliminary report can always be used against you in a court of law.

Opposing counsel can demand discovery on it.

Opposing counsel can try and discredit you with it.

Opposing counsel can demand discovery on it.

(Correct Answers)

Rationale:

The preliminary report is considered a high-risk document because, if written, opposing counsel may demand discovery on it and may also use it to try and discredit Emilia.

Rationale:

The preliminary report is considered a high-risk document because, if written, opposing counsel may demand discovery on it and may also use it to try and discredit Emilia.

Caleb created a hash value on a file he was working on before he left for the day. When he came back the next day, the hash value had changed. Since there was a change in hash value, what did that do to the file Caleb was working on?

The file had been opened.

The file had been altered.

The file had been erased.

The file had been moved.

The file had been altered.

(Correct Answer)

Rationale:

Caleb's file had been altered in some way. Any alteration in a file will cause the hash value to change.

Avraham knows that for a statement to be considered absolutely true, it must be stated conservatively. However, it might be considered a guess if he overreaches. How can Avraham protect his credibility?

By making a statement of limitations of knowledge and uncertainty

Swearing on a Bible

Reading off his CV to the jury

Talking about past cases

By making a statement of limitations of knowledge and uncertainty

(Correct Answer)

Rationale:

Avraham knows that for a statement to be considered absolutely true, it must be stated conservatively. However, it might be considered a guess if he overreaches. He can find greater truth by throwing a wider net and collecting more evidence to support his statement. The narrower the net, or less evidence, the more the evidence becomes a guess.

Jennifer is working at a research lab and is about to write her first report. As she sits down to write, she begins by making a template. Her colleague Mike stops by and tells her that's a bad idea. Why would Mike argue against Jennifer using her own template?

Organizations are picky about who writes report templates.

Organizations likely have established templates for reports.

Organizations want people to ask for permission before creating templates.

Organizations want reports written quickly.

Organizations likely have established templates for reports.

(Correct Answer)

Rationale:

Jennifer should not create her own template because the organization she works for likely has its own template(s) they use for report writing.

Miriam's PDF is about to be put into the e-discovery database. The document has several images in it. When she puts it through the OCR (Optical Character Recognition) software, the text for the images comes out garbled. So before Miriam adds her document to the e-discovery database, what steps should she take to correct the errors she finds?

Run it through the OCR software again and then send it.

Leave it as a PDF.

Give it to someone else to fix.

Check the OCR document and be sure to correct any errors she finds.

Check the OCR document and be sure to correct any errors she finds.

(Correct Answer)

Rationale:

Miriam should fix any issues she finds after running the OCR software before sending the document. That way, there can be no misinterpretation causing an embarrassing situation.

Camilla works for an attorney so she must bill her time by the hour. Time duration is listed in tenths of an hour. How many minutes are there in a 10th of an hour?

10 minutes

12 minutes

6 minutes

5 minutes

6 minutes

(Correct Answer)

Rationale:

Camilla must bill in six-minute increments, which is a tenth of an hour.

Derek is about to write a report for his client. There are a few questions he needs to consider before writing it. What are a few of those questions Derek needs to consider?

Who is the attorney?

Who is the defendant?

What are the defined goals or mission of this examination?

What is the purpose of the report?

What are the defined goals or mission of this examination?

What is the purpose of the report?

(Correct Answers)

Rationale:

Two of the questions Derek needs to consider are What are the defined goals or mission of the examination? and What is the purpose of the report? Who is the attorney? and Who is the defendant? are not germane to this question.

Rationale:

Two of the questions Derek needs to consider are What are the defined goals or mission of the examination? and What is the purpose of the report? Who is the attorney? and Who is the defendant? are not germane to this question.

Yasmin's about to write her report. Her boss Rebecca, hands her the Digital Forensics Report Audience Worksheet to determine the type of audience reading the report. Yasmin sees that the attorney's knowledge of information technology is low, but Steve Billings, a non-legal party, has medium technical knowledge. Knowing this piece of information, how should Yasmin go about writing for her audience?

Yasmin should write for the attorney's knowledge level.

Yasmin should write for Steve Billings' knowledge level.

Yasmin should write for jury's knowledge level.

Yasmin should write for the judge's knowledge level.

Yasmin should write for the attorney's knowledge level.

(Correct Answer)

Rationale:

Yasmin should write for the attorney's level of knowledge since they have the lowest level of knowledge. Steve Billings will be able to understand technology at that level too since he has a medium level of understanding. There is no mention of a judge and jury in the Audience Worksheet.

Jimmy has refined his outline and is now working on his topic sentences. He's unsure how to proceed and how to develop good topic sentences because this is his first time writing a forensic report. Hanska, his friend and mentor, wants to help him through his dilemma but doesn't want to just give him answers. You walk by and hear this conversation. You think you know the answer. What's the purpose of a good topic sentence?

It introduces the main finding of the examination.

It can belong in more than just one section.

It can set the tone for your whole examination.

It provides a clear direction for the rest of the analysis.

It introduces the main finding of the examination.

It provides a clear direction for the rest of the analysis.

(Correct Answers)

Rationale:

A topic sentence introduces the main findings of the examinations and provides a clear direction for the rest of the analysis so that the report flows in a logical manner.

Julian was using Autopsy (a digital forensics tool) to generate a list of files found during an examination. He's new to the field of digital forensics. Before he begins, he needs to know what type of functions Autopsy can perform. You've recently begun working with Autopsy. What can you tell Julian about the program?

Autopsy lists files and compares evidence.

Autopsy describes the evidence, not just a list of the files.

Autopsy provides a list of files. It does not describe the evidence.

Autopsy can file a report but cannot list files.

Autopsy provides a list of files. It does not describe the evidence.

(Correct Answer)

Rationale:

Autopsy is a digital forensics tool that typically generates a list of reports in text format, word processing formats, HTML, and spreadsheets to name a few. It does not describe evidence.

Solomon is working on a case that is garnering a lot of media attention. every time he leaves the courtroom, he is swarmed by reporters. One day he finally gets away and is sitting by himself having lunch, when a single reporter approaches him. This reporter, Jessica, says to Solomon, everything you tell me will be off the record, so could you tell me about the case? Why should Solomon tell Jessica he can't speak to her?

Solomon's comments could harm the case and create a record that can be used against him.

Solomon's comments could show he's impartial to this case.

Solomon has no control over the context of the information a journalist publishes.

Journalists don't care what Solomon thinks, they just want to sell newspapers.

Solomon's comments could harm the case and create a record that can be used against him.

Solomon has no control over the context of the information a journalist publishes.

(Correct Answers)

Rationale:

Solomon must say no because anything the journalist writes could harm the case and create a record that could be used against him now and for future cases and anything Solomon says could be taken out of context.

Amelia is about to begin work on a new forensic examination. As she is preparing to process the evidence, the one thing that she must always keep in mind is to keep her opinions to a minimum. Why is it important for Amelia to keep her opinions to a minimum during an examination?

Amelia must keep her opinions to a minimum to maintain her experience.

Amelia must keep her opinions to a minimum to maintain her composure.

Amelia must keep her opinions to a minimum to maintain her impartiality.

Amelia must keep her opinions to a minimum to maintain her credibility.

Amelia must keep her opinions to a minimum to maintain her impartiality.

Amelia must keep her opinions to a minimum to maintain her credibility.

(Correct Answers)

Rationale:

Amelia must keep her opinions to a minimum for the sake of her credibility and impartiality. It is important to maintain an appearance of not showing bias or having a vested interest in the outcome of any case.

As a forensic examiner, Jakob can apply his skill set in two different ways when testifying. He can be either a fact witness or an expert witness. What are the main differences between being a fact witness and an expert witness?

As a fact witness, Jakob provides only the facts he has found in his investigation. As an expert witness, he forms opinions from experience and deductive reasoning based on facts found during an investigation.

As an expert witness, Jakob provides only the facts he has found in his investigation. As a fact witness, he forms opinions from experience and deductive reasoning based on facts found during an investigation.

Expert and fact witnesses base testimony on facts and experience alone.

It's the facts that make Jakob a fact witness; it's his opinion that makes him an expert witness.

As a fact witness, Jakob provides only the facts he has found in his investigation. As an expert witness, he forms opinions from experience and deductive reasoning based on facts found during an investigation.

It's the facts that make Jakob a fact witness; it's his opinion that makes him an expert witness.

Rationale:

Jakob can be either a fact or expert witness depending on the needs of the client. As a fact witness, Jakob relies only on the facts in his investigation and as an expert witness, he forms opinions from experience and deductive reasoning based on facts of the case. It's his opinion that makes him an expert witness.

Samantha is about to be questioned for the first time about her qualifications as an expert witness. She hears the attorney she works for calling it voir dire. Samantha wants to know what "voir dire" means. What does Samantha's attorney tell her the translation means?

To see, to say

To hear, to look

To be or not to be

To say, to see

To see, to say

(Correct Answer)

Rationale:

Samantha's attorney tells her that the phrase comes from French, and it literally means "to see, to say."

Gretchen is about to give oral testimony and wants to be sure that the jury understands it clearly. What's the best way to impart her testimony to help listeners retain what's being said?

Graphical presentation

Copious notes

Detailed explanation

Simple explanation

Graphical presentation

(Correct Answer)

Rationale:

There is a saying that a picture is worth 1000 words. Graphical images are much easier to assist in the audience retaining evidence than it is to listen to someone speak about evidence.

Carlos is an independent contractor. He recently went to work for the law firm of Bartlet and James. He was beginning work on a new case involving an aerospace firm. One day, he gets a call from Jim Lacy, the opposing attorney from the firm of Cagney and Marcy and asks him to discuss the case with him. Carlos says "no" and quickly hangs up the phone. Why does Jim want to speak with Carlos about the case?

Jim is interested in Carlos' opinion about the case.

Jim wants Carlos's help on a part of the case.

Jim wants to conflict out Carlos.

Jim wants to find out how much Carlos is being paid.

Jim wants to conflict out Carlos.

(Correct Answer)

Rationale:

Jim wants to conflict out Carlos. By speaking with Carlos about the case, it will prevent Carlos from working on it. Jim can say Carlos has a conflict of interest by speaking to him about the case.

Jesus is testifying for the first time in a big case for General Computing Corp. The judge has ordered a ten-minute recess, and Jesus realizes he has a question for General Computing Corp's attorney. So, Jesus runs to catch Martin, the attorney, in the hallway. Jesus is speaking to Martin when the opposing counsel sees them talking. What are the possible repercussions of the interaction between Jesus and Martin?

There are no repercussions from the conversation between Jesus and Martin.

Opposing counsel can demand that Jesus explain and repeat the conversation he had with Martin.

Repercussions can include fines for misconduct.

The case is thrown out on a technicality.

Opposing counsel can demand that Jesus explain and repeat the conversation he had with Martin.

(Correct Answer)

Rationale:

If opposing counsel sees Jesus and Martin speaking in the hallway, Jesus can be cross-examined by opposing counsel who can demand that Jesus explain what he and Martin were speaking about.

Filipa is working for the Sussex County DA's office. She comes across some evidence she believes is exculpatory (evidence that exonerates or diminishes the defendant's liability) and tells the District Attorney about it emphasizing its exculpatory nature. DA Jennifer Donner sets it aside and doesn't do anything about it. Filipa has tried several times to get DA Donner to look at it. Filipa is worried an innocent man might go to jail. What is Filipa's next course of action?

Tell the defense attorney.

Keep attempting to prompt the DA to do something about it.

Drop it.

Report the lack of disclosure to the judge.

Report the lack of disclosure to the judge.

(Correct Answer)

Rationale:

If Filipa has all her attempts documented and has tried several times to get the DA to disclose the evidence to the defense, she can report the DA's lack of disclosure to the judge. Her obligation is then complete.

Ambrus is in a discovery deposition. The opposing counsel Mark Miller is just about to finish up. At the end of the session Mark asks Ambrus if he would like to waive signature. Ambrus says no. Why is Ambrus not waiving signature on the deposition?

Not waiving signature will avoid delays in the deposition process.

Not waiving signature allows for review and corrections.

Not waiving signature will avoid disputes.

Not waiving signature will keep you from making commitments.

Not waiving signature allows for review and corrections.

(Correct Answer)

Rationale:

Ambrus does not want to waive his signature, so he has time to review and make corrections on the corrections page. Then he will sign the deposition.

Gabriel is an expert witness on ransomware attacks across Canada. He is working on his analysis of the crime when his supervisor, Antonia, comes up to him and says, "Forget about going to court for now, you are needed in the House of Commons!" Gabriel is concerned. Why would they need him in the House of Commons (Canada's Legislative body)?

He's in trouble for knowing too much about ransomware.

They are seeking his testimony because they are contemplating making a rule or legislation.

He is going there for a matter unrelated to ransomware.

They want to look like they're doing something in front of the TV cameras.

They are seeking his testimony because they are contemplating making a rule or legislation.

(Correct Answer)

Rationale:

The House of Commons wants Gabriel's testimony because they are contemplating making a rule or legislation governing legal recourse for ransomware attacks.

Roseline is an attorney for the firm Dewy and Howe. Her expert witness for a case is Stanley. Roseline and Stanley are discussing the case before they arrive at the courtroom. Roseline tells Stanley not to worry or get defensive about what's about to happen in the courtroom. "This is common occurrence in judicial hearings." Roseline tells Stanley, "The judge and attorneys will be focusing on certain areas of your forensic examination." Which areas of Stanley's forensic examination will more than likely be the focus of the preliminary hearing?

The procedure for obtaining and preserving evidence

The basis or authority (warrant or probable cause) for Stanley conducting the examination

Rules and procedures for the trial

Rules and procedures for the witnesses

The procedure for obtaining and preserving evidence

The basis or authority (warrant or probable cause) for Stanley conducting the examination

(Correct Answers)

Rationale:

The areas of focus for Stanley will be on the procedures in obtaining and preserving evidence as well as the basis or authority (warrant or probable cause) for Stanley to conduct the examination.

Mateo is working with Devo Corp. to build a new forensic lab facility. He knows that he must put a lot of thought into a particular part of the build when determining lab expenses. What expense is Mateo most concerned about?

Visual security of the facility.

Aural (sound) security of the facility.

Physical security of the facility.

Digital security of the facility.

Physical security of the facility.

(Correct Answer)

Rationale:

Mateo is concerned about the physical security of the facility because evidence that is not safe can be lost, corrupted, or destroyed.

Joseph is the lab manager for Pavlon Corp., and he is looking at the visitor name roster with the new day guard Henderson. Joseph comes across the name Nosmo King (No Smoking) with today's date next to it. Joseph is suspicious and asks Henderson if he let this person into the lab, Henderson says, "he tried to get in, but I wouldn't let him." Why wouldn't Henderson let

Nosmo King into the lab?

Nosmo's ID was fake.

Nosmo changed his mind.

Nosmo was in the wrong building.

Nosmo already had what he was looking for.

Nosmo's ID was fake.

(Correct Answer)

Rationale:

Henderson looked at Nosmo's ID and discovered that it was fake. He then escorted Nosmo out of the building.

Malik is in the network design phase for a forensics lab. He needs to build one local area network for the forensic workstations and one that is air gapped (not on the same network as the forensic network) for the computers with Internet access. Malik knows it's important that Internet facing workstations must not connect to forensics workstations. Why is it important to have two separate networks for a forensics lab?

Because Internet access on the forensics network can inhibit employee productivity.

Because Internet access on the forensics network can severely decrease workstation. Bandwidth.

Because Internet access on the forensics network can fill hard drives with worthless data.

Because Internet access on the forensics network can contaminate evidence.

Because Internet access on the forensics network can contaminate evidence.

(Correct Answer)

Rationale:

Malik must have two networks in the lab. One for the forensic workstations and one for Internet access. If the Internet facing machines were to be allowed on the forensics network, the forensics workstations could be subject to attack or internal/external contamination.

Imka works in a forensic lab for a small local police department. The average population income falls just above poverty level, but most schools have some computers from donations, and some residents have computers too. What type of hardware and software should Imka have, given this small community?

Legacy hardware systems and software.

Up-to-date hardware and software.

Equipment that's less than 3 years old.

Make her own.

Legacy hardware systems and software.

(Correct Answer)

Rationale:

Given the size of this community, chances are that Imka should keep legacy systems and software available because computers in this community are usually kept much longer than those in larger, more computer-literate communities.

Matilda works in a police crime lab in the city of Ontario. There are manufacturing firms in Ontario that employ over 100,000 employees. Based on the crime reports that Matilda has consulted, statistically about 1% of those employees could be involved in criminal behavior at some point in time. Matilda now knows how many employees could be involved in a crime. What's the total number of potential employees involved in criminal behavior?

10,000

100

1,000

10

1,000

(Correct Answer)

Rationale:

Matilda knows that 1% of 100,000 employees equals 1,000 potential crimes according to the criminal statistics she has read.

Gabriela is setting up a workstation specifically to crack passwords. To crack passwords quickly, Gabriela needs to pick a workstation where she can install multiple graphics processing units (GPUs).

True

False

True (Correct Answer)

Rationale:

Gabriela's use of multiple GPUs will allow multiple processors to work on cracking passwords without using the core processing unit, thereby allowing the computer to continue to work on other projects while cracking passwords in the background.

Sara needs to work with her management team to create a disaster recovery plan. She tries to take all possibilities into account while planning. Out of all things considered disasters, which of the following possibilities is not?

Forensic workstation hard disk crash.

Lightning strike causing the building to lose power.

Power outage two blocks away.

The lab floods with water.

Power outage two blocks away.

(Correct Answer)

Rationale:

Although Sara and her team need to be alert if there is a power outage two blocks away, it's not considered a disaster.

Arno is about to buy a computer and build it into a forensics workstation. What are the three most important factors Arno must consider for purchasing a computer and converting it into a forensic workstation?

Graphic processing unit (GPU), central processing unit (CPU), and monitor size

CPU, RAM, and disk storage

Graphics card, number of available USB ports, and motherboard

Motherboard, pata ports, and sata ports

CPU, RAM, and disk storage

(Correct Answer)

Rationale:

Arno must get the most powerful processor (CPU), the most RAM, and the largest disk storage available for his workstation. Other peripheral devices like GPUs and bigger monitors can be added later.

Martina is about to store her backups from the last session. In the event of a disaster, they need to be kept safe. So how is Martina going to store her backups?

Two backups onsite, nothing offsite

Two duplicate backups offsite, nothing onsite

One backup onsite, one duplicate

offsite, and one previous backup offsite

Zero onsite and all duplicates offsite

One backup onsite, one duplicate

offsite, and one previous backup offsite

(Correct Answer)

Rationale:

Martina should keep one backup onsite for easy retrieval, one duplicate backup offsite, and one older backup offsite.

Hershel wants to build a forensics lab, but he needs to gain the support of his management team to do so. What document does Hershel need to create to justify building his lab?

Business case

Document case

Organizational case

Legal case

Business case

(Correct Answer)

Rationale:

Hershel needs to build a business case to provide justification for establishing or upgrading his lab.

Liam is writing a business case for his employer, Champ Industries. When writing a business case, Liam must take into consideration that it needs to be updated regularly. How many times a year should Liam update his business case?

Every six months

Quarterly

Annually

Bi-yearly

Annually

(Correct Answer)

Rationale:

Liam should update the business case annually.

Willow is building a business case for Verta Corp. because her management team wants a new forensics lab. One item on the list that Willow needs to mention is profitability. How can Willow explain that a forensic lab can be profitable?

Protecting intellectual property

Protecting trade secrets and future business plans

Protecting employees from physical injury

Protecting the company network

Protecting intellectual property

Protecting trade secrets and future business plans

(Correct Answers)

Rationale:

Willow's business case can demonstrate profitability by mentioning to her team that protecting intellectual property, trade secrets, and future business plans are profitable in that they mitigate risk (saves the company money).

Rationale:

Willow's business case can demonstrate profitability by mentioning to her team that protecting intellectual property, trade secrets, and future business plans are profitable in that they mitigate risk (saves the company money).

Koa is researching private-sector versus public-sector business cases for forensics labs. What was Koa's conclusion regarding the main difference of a business case for private-sector (corporation) and public-sector (police department)?

Police departments must always show cost recovery for additional capabilities.

Corporations must always show cost recovery for additional capabilities.

Police departments don't always have to show cost recovery for additional capabilities.

Corporations don't always have to show cost recovery for additional capabilities.

Police departments don't always have to show cost recovery for additional capabilities.

(Correct Answer)

Rationale:

Koa's research found that police departments don't always have to show cost recovery for additional capabilities and new resources.

Delilah is working on data acquisition, which is one of the first tasks in digital forensics. Jamal, a friend of hers, doesn't know what digital forensics is and asks Delilah to explain it. So, Delilah gives him a basic idea of what she is working on. What does Delilah tell Jamal?

She's making a physical copy of the data.

She's making a logical copy of the data.

She's making a backup copy of the data.

She's making a bootleg copy of the data.

She's making a physical copy of the data.

She's making a logical copy of the data.

(Correct Answer)

Rationale:

Delilah is working on physical data copies and logical data copies.

Sofia is investigating a fraud case. She is searching for relevant data and needs to narrow her search parameters to separate good data from bad data. What type of search should Sofia use?

Word phrase search

Key phrase search

Keyword search

.pdf search

Keyword search

(Correct Answer)

Rationale:

To narrow down search parameters, Sofia should use a keyword search to separate good data from bad data.

Miko prefers using command-line tools over GUI tools. When her friend Justin asked why, Miko said she prefers them to GUI tools for a specific reason. What's the reason Miko prefers command-line tools?

Command-line tools are more precise than GUI tools.

Command-line tools are easier to use.

Command-line tools require minimal system resources.

Command-line tools take less time to learn than GUI tools.

Command-line tools require minimal system resources.

(Correct Answer)

Rationale:

Miko prefers using command-line tools because they require minimal system resources.

It is important to continue learning about command-line tools because some GUI tools might miss critical evidence.

True

False

True

(Correct Answer)

Rationale:

GUI tools can miss critical evidence that command-line tools may discover.

Berat is working on his first mobile examination. But he does not have the tools to acquire mobile device data. What company offers frameworks necessary for Berat to continue his examination?

Apple

Microsoft

Samsung

Nokia

Samsung

(Correct Answer)

Rationale:

Berat needs Samsung mobile frameworks to assist in acquiring mobile device data.

Miray is examining a Windows 10 computer and needs to determine file ownership on the computer since there were multiple users. What command does Miray use?

ls

rm

mv

dir

dir

(Correct Answer)

Rationale:

In Windows 2000 and later, Miray can use the dir command to show file ownership if there are multiple users on a computer.

José manages a busy lab where the equipment runs 24/7. For this reason, he needs to schedule periodic equipment replacement. How often should José replace his equipment when it's under heavy usage?

12 months

18 months

24 months

36 months

18 months

(Correct Answer)

Rationale:

Under heavy usage, José should ideally schedule equipment replacement every 18 months.

Francis needs to purchase a device for his workstation that allows him to connect to a suspect's drive without changing data files. What's the name of the device that Francis needs to purchase?

Read-blocker

SPARC-blocker

SCSI-blocker

Write-blocker

Write-blocker

(Correct Answer)

Rationale:

Francis needs to purchase a write-blocker so that the data and metadata he explores cannot be changed.

Ricardo is looking to acquire a forensic workstation. He has a limited budget to work with. He can't build his own nor can he purchase a workstation such as a FRED unit. What's the best way for Ricardo to spend his limited budget?

Buy a used computer

Use his existing computer and get a write-blocking device

Buy a high-end gaming PC

Buy the cheapest new computer he can find

Buy a high-end gaming PC

(Correct Answer)

Rationale:

Ricardo should buy a high-end gaming PC. With some minor modifications, these systems work extremely well.

Hakim is analyzing evidence to be admitted in court. What must Hakim do to ensure his evidence can be admissible in court?

Test and validate his software

Test and validate his hardware

Analyze his evidence carefully

Be sure his company's software licenses are up-to-date

Test and validate his software

(Correct Answer)

Rationale:

Hakim's software tools must be tested and validated for recovered evidence to be admitted in court.

Milo is researching hashing algorithms. He wants to know the hashing algorithm with the best accuracy to reduce the number of known files such as OS or program files so that only unknown files remain. Which hashing algorithm does Milo decide to use?

MD5

DES

SHA-1

3DES

SHA-1

(Correct Answer)

Rationale:

Milo discovers that SHA-1 has better accuracy than other hashing methods, such as MD5.

Xander needs to examine a .pst file. He wants to use his disk editor, but he's uncertain. Why is Xander unsure about using a disk editor?

A disk editor only works with hex files.

A disk editor is not a flexible tool.

A disk editor does not work with .pst files.

A disk editor might not be capable of examining a compressed file's contents.

A disk editor might not be capable of examining a compressed file's contents.

(Correct Answer)

Rationale:

Xander may not be able to use his disk editor because it might not be capable of examining compressed file content such as a .zip file or an Outlook .pst file.

Winnie is deciding whether to collect her forensic data in an open source or proprietary format. There are advantages and disadvantages to both, but she wants her data read by as many forensic tools as possible. Which format should Winnie use to achieve her objective?

Proprietary format

Raw format

Single format

Evidence format

Raw format

(Correct Answer)

Rationale:

Winnie uses the raw format since it is compatible with most forensic tools.

Keira was at a remote site collecting data evidence. She needs to take a break, so how does she keep her data collection secure from tampering?

She can leave just for a short amount of time.

She can ask somebody nearby to watch the computers for her.

She puts crime scene tape around the location.

Another authorized person must always be present.

Another authorized person must always be present.

(Correct Answer)

Rationale:

Keira must ensure that there is another authorized person present who is available to stand guard over the acquisition to maintain continuous control of the evidence.

Reilynn is performing a static acquisition. She's creating a physical disk-to-image, which is the most common method of acquisition and offers the most flexibility for an investigation. What are some of the features that make physical disk-to-imaging method so flexible?

Compatible with all operating systems

Copies are bit-for-bit replicas of the original drive

Many copies of a suspect's drive can be made

Individual files can be easily restored

Copies are bit-for-bit replicas of the original drive

Many copies of a suspect's drive can be made

(Correct Answers)

Rationale:

Reilynn can make as many bit-for-bit replicas of the original drive as required by her forensics department.

Vanessa is in the process of conducting an email investigation that requires only collecting Outlook .pst files. Since .pst files are extremely large, and this is an e-discovery case, what is the preferred method of data acquisition that Vanessa should use?

Partial acquisition

Sparse acquisition

Complete acquisition

Logical acquisition

Logical acquisition

(Correct Answer)

Rationale:

Vanessa is using logical acquisition, which is becoming the preferred method in e-discovery for the purpose of litigation.

Jackie is working with large files on her forensic acquisition. She needs to compress them to fit on her target drive and must use a compression algorithm that does not alter the original data. What algorithm must Jackie use to prevent alteration of the original data?

lossy

AAC

Lossless

MPEG

Lossless

(Correct Answer)

Rationale:

Jackie uses lossless compression, which does not alter the original data.

Kenneth is testing the accuracy of his compressed file (lossless). Once he checks the before and after compression hash values, he finds they do not match. What could be the reason for this error?

Software error

Hardware error

System crash

The file itself

Software error

Hardware error

(Correct Answers)

Rationale:

If the hashes didn't match, Kenneth could have experienced either a hardware or software error that could have corrupted the compressed file.

Tehya is preparing for a Digital Forensics acquisition. Preparation is key to reducing potential failure. What are some of the key elements Tehya must consider before initiating her acquisition?

Is the source drive accessible or is it still in the suspect's computer?

Will Tehya be able to retain the source drive, or will it need to be returned to the owner?

Has the source drive been compromised by being misplaced?

Has the original source drive been destroyed?

Is the source drive accessible or is it still in the suspect's computer?

Will Tehya be able to retain the source drive, or will it need to be returned to the owner?

(Correct Answer)

Rationale:

Tehya needs to find out if the source drive is accessible or is it still in the suspect's computer. She also needs to know if she can retain the original source drive or must she return it to the owner.

Bella is about to decrypt a hard drive. The best thing about decryption is that allocated data and unallocated data are not altered when the drive is decrypted. However, Bella does have a big concern about whole disk encryption. What is Bella concerned about?

Cracking the password or passcode

Recovering the decryption key

Automating the decryption process

Making sure there is enough drive space

Cracking the password or passcode

Recovering the decryption key

(Correct Answers)

Rationale:

Bella's concern is cracking the password or passcode. She can get the decryption key by using a tool such as Elcomsoft Forensic Disk Decryptor or she could guess the password.

Greta wants to determine drive letter, file system, and other properties information regarding a computer she is investigating. What PowerShell command will she run to retrieve this data?

Get-process

Get-wmiobject

Get-volume

Get-item

Get-volume

(Correct Answer)

Rationale:

Greta will use the get-volume command in PowerShell to retrieve information regarding logical disks, drive letters, file system, size, free space, and other properties associated with each volume.

Colin is examining an x86 computer with a disk drive that uses a Master Boot Record (MBR). What firmware program does Colin need to be familiar with when examining this boot process?

EFI

UEFI

BIOS

CMOS

BIOS

(Correct Answer)

Rationale:

For Collin to examine a x86 computer with a Master Boot Record, he must be familiar with BIOS.

Jeremiah is looking for where the system configuration, date, and time information is stored when the power to the system is off. He's new to the field of Computer Forensics, so he needs some help. Where will Jeremiah find the information he's looking for?

BIOS

CMOS

GUID

UEFI

CMOS

(Correct Answer)

Rationale:

Jeremiah will find system configuration, date, and time information stored in CMOS when power to the system is off.

Cindy is working on two computers, one is an x86 and the other is a x64. Her boss Tim tells her to work on the x64 first. What disk format and system I/O hardware is Cindy working with?

BIOS (Basic Input/Output System)

Unified Extensible Firmware Interface (UEFI)

Master Boot Record (MBR)

GUID Partition Table (GPT)

Unified Extensible Firmware Interface (UEFI)

GUID Partition Table (GPT)

(Correct Answers)

Rationale:

For an x64 system, Cindy is working with GPT and UEFI.

Wendell is initiating a static acquisition on a suspect's computer. First thing he does is access the CMOS set up to verify settings. Why is Wendell accessing the CMOS setup first?

To confirm it boots to the forensically configured media first

To confirm it boots to the hard drive first

To confirm it boots to the network drive first

To confirm it boots to a floppy drive first

To confirm it boots to the forensically configured media first

(Correct Answers)

Rationale:

Wendell needs to ensure that the computer boots to a forensically configured CD, DVD, or USB drive first and not a drive without forensically configured media.

Navi is collecting evidence for his case, but he only needs to acquire specific files and no other data, so he is using the xcopy/s command. What is Navi trying to copy?

List file name source and its destination name

If errors are encountered, continues to copy data

Copies all folders that contain data and ignores empty folders

Copies only files that have the attribute set on

Copies all folders that contain data and ignores empty folders

(Correct Answer)

Rationale:

Navi uses the xcopy/s command to copy all folders that contain data and ignores empty folders.

Jorge is working on an e-discovery case. He only needs the data files that are required for evidence collection. He wants to know where the files are located on the drive, so what command will Jorge use to find that information?

robocopy/v

robocopy/fp

robocopy/tee

robocopy/xc

robocopy/fp

(Correct Answers)

Rationale:

Jorge will use robocopy/fp to display the full pathname for where the files are located on the drive.

Naya has been handed a hard drive to begin a forensic examination. It is not a new hard drive, it's from a case that's a few years old. Naya erases the hard drive but does not zero it out (completely erase the drive by overwriting it with zeros and ones) so there is a possibility that data from the old case may have survived the erasure. Naya's manager hears that opposing counsel wants to review the target drive. What's the possible outcome from the opposing counsel's review of Naya's target drive?

Commingling of previous case data can lessen or discredit Naya's work.

Wiping the target drive should be enough to prevent commingling of data.

The jury will understand that recovered data is unrelated to the case.

Previous case files cannot be admitted as evidence, so they are not important.

Commingling of previous case data can lessen or discredit Naya's work.

(Correct Answer)

Rationale:

If opposing counsel finds commingled data from a previous case, they can lessen or discredit Naya's work during a hearing or trial.

Rumi is acquisitioning a 4TB drive for a windows computer. She wipes her target drive and then needs to format it. What drive format should Rumi use on a 4TB drive?

exFAT

FAT32

NTFS

HFS+

NTFS

(Correct Answer)

Rationale:

Since the drive is over 32 GB, and a windows machine, Rumi should use NTFS.

Hector is validating digital evidence using a hashing algorithm utility that creates a binary or hexadecimal number that represents the uniqueness of the data set. Because it is unique, a binary or hexadecimal number is often referred to as a "digital fingerprint."

True

False

True

(Correct Answer)

Rationale:

The binary or hexadecimal number that represents the uniqueness of a data set is often referred to as a digital fingerprint. If any alteration is made in the file, the fingerprint (hash value) will be changed.

Wendy is using Linux and needs to split a nonsegmented volume (single continuous block of storage) into multiple segments of volumes. What command will Wendy use?

dcfldd

dc3dd

dd

splt

dd

(Correct Answer)

Rationale:

Wendy uses the dd command because it is best for splitting nonsegmented volumes into segmented volumes.

Gabriela just received a newly examined hard drive that has already been hashed. Before she continues her part of the examination, she uses Autopsy and calculates a new hash and discovers that the two hashes are not the same. What does Gabriela's finding prove about the evidence?

The evidence is tainted and can't be used.

The evidence is not affected.

The evidence may be affected but it needs to be examined.

It doesn't matter if the hashes don't match.

The evidence may be affected but it needs to be examined.

(Correct Answer)

Rationale:

Gabriela must take this evidence to an examiner who will determine what the differences are and how they may affect the case. In this case, hashed changes don't necessarily eliminate the evidence.

Donna just ran an image on an SSD through Autopsy to get a hash value. She then placed it into evidence storage. However, when she got the SSD out of storage, the periodic maintenance functions of the SSD erased unallocated areas altering hash values. What should Donna do to avoid this error in the future?

Disable the wear leveling function

Disable the garbage collection function

Disable the TRIM function

Disable the block function

Disable the TRIM function

(Correct Answer)

Rationale:

Donna should disable the TRIM function for all SSD devices that are stored into evidence.

Beatriz is examining a Windows NT server and discovers a RAID array. What version of RAID did Beatriz find?

RAID 0 or 1

RAID 2 or 5

RAID 3 or 4

RAID 6 or 10

RAID 0 or 1

(Correct Answer)

Rationale:

Beatriz is examining a Windows NT server and therefore RAID 0 or 1 is the available option.

Albert is examining a hard drive and discovers there are many bad sectors on the drive. Which forensic tool does Albert decide to use for this problem?

ASR Data SMART

ILookIX IXImager

PassMark Software OSForensics OSFClone

RunTime Software DiskExplorer

ASR Data SMART

(Correct Answer)

Rationale:

Albert uses ASR Data SMART forensics tool because it has robust data reading capabilities for bad sectors on drives.

Quinn has been sent into the field to examine several Windows 10 laptops to acquire their data. He can choose from several commercial forensics tools, but he is limited to the bootable media he can use. What form of media should Quinn take with him that's almost always available on today's modern laptops?

Thumb drive

CD

FireWire

SCSI

Thumb drive

(Correct Answer)

Rationale:

USB ports are almost universal on modern laptops. CD/DVD players no longer come built in. So, it is in Quinn's best interest to bring a bootable USB thumb drive.

Lia's next forensics acquisition is a tough one. She cannot go into the client's office and exfiltrate (remove) the data from the source computer. Lia decides to use X-Ways Imager. In this situation, what makes X-Ways Imager the best tool for Lia to use?

X-Ways can clone a network computer's drives.

X-Ways can connect to a network computer's drives.

X-Ways can quickly acquire data from a remote-connected computer.

X-Ways can quickly acquire data from connected SCSI drives.

X-Ways can quickly acquire data from a remote-connected computer.

(Correct Answer)

Rationale:

Lia's best option is to use X-Ways Imager since it can quickly acquire data from a remote-connected computer.