Forensics Chapter 1

Mahmood is examining a device for digital evidence. There are two types of evidence he is looking for. Which type of evidence will prove that his client is not guilty?

Inculpatory evidence

Exculpatory evidence

Miaculpatory evidence

Discretionary evidence

Exculpatory evidence

When conducting a computer investigation for potential criminal violations of the law, the legal processes you follow depend on local customs, legislative standards, and rules of evidence. In general, however, a criminal case follows three stages. What are those three stages?

Complaint, the investigation, and the prosecution

Complaint, discovery, and the trial

Complaint, service of process, and motions

Complaint, answer, discovery, and trial

Complaint, the investigation, and the prosecution

Allen works for a small newspaper. There is no corporate security investigations group, no written or verbal acceptable use policy, and the publisher (owner) owns the rights to all the computer hardware and software. One day, the publisher calls him into the office and asks him to help them with an email problem. Upon fixing the problem Allen discovers that there are illicit photos (no one was underage) on the publisher's laptop. The publisher later asks Allen to sanitize the laptop because the publisher wants to give it to their grandson. Allen must go through the laptop to find all the photos. What can Allen do to stop this work behavior?

Report the publisher to Human Resources

File a hostile work environment claim

Sanitize the laptop and do nothing else

Refuse to do the job

File a hostile work environment claim

Thanks to the dark web, anybody can access computer programs that will help users exfiltrate (remove) data from any type of computer or network. Because of this activity, white-collar crime and industrial espionage are on the rise. How does white-collar-crime compare to industrial espionage?

White-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

Espionage refers to financial crimes committed in a business or professional setting, while white collar crime refers to the unauthorized sharing of confidential information to a competitor or foreign entity.

White-collar crime is the same as espionage and are both punishable offenses.

White-collar crime and espionage are victimless crimes.

White-collar crime refers to financial crimes committed in a business or professional setting, while espionage refers to the unauthorized sharing of confidential information to a competitor or foreign entity. (Correct Answer)

Kwan is a Digital Evidence Specialist and is looking for a new job. He has an immaculate resume, fantastic references, and an excellent work history. But on the weekends, he likes to go out and get drunk, play beer pong, get high, and to post a lot of selfies to his social media sites. Recently, he applied to Jaffe Corporation for a Digital Evidence Specialist position. The interview went well. In fact, Jaffe is looking to hire him for a project, but upon further investigation, they decide not to. What might the deciding factor have been in Jaffe Corp. not hiring Kwan?

Kwan's selfies of getting drunk and high show a critical lack of judgment. Those images could allow an opposing attorney to discredit him due to his behavior. (Correct Answer)

Lucy needs to make a forensic initial assessment about a case she is investigating. What are some of the steps she needs to take for the assessment?

Has law enforcement apprehended a suspect?

Have law enforcement or company security officers already seized the computer, disks, peripherals, and other components?

Was a computer or a laptop found?

Is the president of the company available?

Have law enforcement or company security officers already seized the computer, disks, peripherals, and other components? (Correct Answer)

Carmon needs to determine what the preliminary approach to a case should be. What are some of the general steps she needs to follow to investigate the case?

Create a detailed check list, determine resources you need, obtain, and copy an evidence drive

Check fingerprint databases, search rainbow tables, speak with police personnel

Identify suspects, check the DMV, talk to crime scene investigators for evidence that might have been missed

Identify the risks, mitigate, or minimize the risks, test the design, investigate the data recovered

Create a detailed check list, determine resources you need, obtain, and copy an evidence drive

Identify the risks, mitigate, or minimize the risks, test the design, investigate the data recovered

(Correct Answers)

Joe has been tasked with investigating an incident at Zander Corp. What is the first rule he must follow that is important for all investigations, no matter how big or small?

Categorizing the evidence

Stabilizing the evidence

Preserve the evidence

Detain the evidence

Preserve the evidence (Correct Answer)

Jennifer is about to take over a computer crime case at Amcore lab. Before she begins, must verify that the chain of custody has not been broken. She discovers that the seal on the container on the suspect's hard drive has been broken and there is no signature on the sign out sheet that someone took the hard drive for analysis. How does this affect the chain of custody?

It does nothing to the chain of custody.

It only affects authenticity.

It breaks the chain of custody.

The custody of the data's journey is now refutable but can still be admissible.

It breaks the chain of custody. (Correct Answer)

Akikta has been given a Windows 10 computer that needs to be investigated. Mostly, he will be recovering deleted files, and checking unallocated space on the hard drive. What are some software Akikta may want to use?

FTK Imager, X-Ways Forensics, and dd

EnCase, FTK, and Autopsy

Photorec and Scalpel

md5sum and sha256sum

EnCase, FTK, and Autopsy

Photorec and Scalpel

(Correct Answers)

Kailani is about to take possession of a Windows 2000 computer for forensic investigation. Why must Kailani use older forensic tools for this Windows 2000 computer?

Windows 2000 is too advanced

Windows 2000 is a legacy system

Windows 2000 is no longer used in production networks

Windows 2000 no longer works

Windows 2000 is a legacy system

Ethel is transporting a computer to her forensic lab, and she needs to secure the device before transport. What does Ethel need to do to ensure that the computer maintains chain of custody and arrives intact at her lab?

Put the entire tower or laptop in a Faraday box or bag

Transport the drives in separate vehicles from the tower or laptop

Place evidence tape over drive bays and insertion slots for power supply cords and USB cables

Place everything in her trunk and lock it so it can't be stolen

Place evidence tape over drive bays and insertion slots for power supply cords and USB cables

Place everything in her trunk and lock it so it can't be stolen

Haris is presented with a case by a client involving employee termination. He hasn't been told about the case yet, but he can guess. What are some of the predominate types of issues that occur in an employee termination case?

Working from home

Creating a hostile work environment

Playing games

Surfing the Internet

Creating a hostile work environment

Fumiko will be conducting an investigation involving Internet abuse on a client's internal private network. What will he need to gather from his client's network administrator?

The suspect's computer IP address

The client's ISP IP address

The client's router IP address

The organization's Internet proxy server logs

The suspect's computer IP address

The organization's Internet proxy server logs

During an investigation, Jerry discovers that there were no matches between the network server logs and the forensic examination showing no contributing evidence that a crime was committed. What does this mean for the investigation?

The allegations were unsubstantiated and there was no misconduct

The allegations were substantiated and there was misconduct

There were no allegations, just conjecture

It was all a misunderstanding

The allegations were unsubstantiated and there was no misconduct (Correct Answer)

Quan-Van is working on a case that's attorney-client privilege (ACP). The attorney asks that all correspondence with them be verbal. What is the reason behind this request?

The attorney doesn't like to read

There will be too much paperwork

Anything written down is subject to discovery

Anything written down must be done in a very specific way

Anything written down is subject to discovery

Olga is about to embark on her first overseas Internet abuse case. She knows the privacy laws of her state as she has worked on Internet abuse cases on a regular basis. The client she is working for is in Germany so she can easily perform the investigation the same way in Germany as she does in the United States.

True

False

False

Dakarai has many legacy operating systems on his forensic workstation as well as the newest OSs, but he has only the most up-to-date software on his day-to-day workstation. Why does Dakarai need legacy operating systems?

It's not taking up much space on his forensic station, so why bother?

It's cheaper to keep the older software around.

Dakarai hasn't gotten around to getting rid of the old software yet.

Older computer systems may not be compatible with modern software.

Older computer systems may not be compatible with modern software. (Correct Answer)

Rivka is building a forensic workstation and needs to buy some hardware to get started. What are some of the types of hardware she will need to buy?

A workstation running Windows 7

A write-blocker device, spare PATA and SATA ports

Network interface card (NIC)

Graphics card

A write-blocker device, spare PATA and SATA ports

Network interface card (NIC)

Kevin is about to begin an examination of a hard drive. Out of all the tools available to him, which one is the most important to keep the OS from writing data to the hard drive?

SCSI card

Network interface card (NIC)

Write-blocker

Target drive

write-blocker

Gerald is using MS-DOS 6.22 to examine a legacy hard drive. Why would Gerald use such an old operating system?

Other DOS OSs are no longer available.

Other DOS OSs do not have the appropriate tools.

It's the only DOS OS that works with older digital forensic tools.

It is the only DOS OS that's least intrusive to disks.

It is the only DOS OS that's least intrusive to disks.

Isabella is conducting an investigation for a client. She will need to copy evidence from a disk using multiple methods. Why can't she use just one method?

It's just for backup purposes.

No one media type can be trusted.

No single method retrieves all data from a disk.

Analyzing data is a tricky job.

No single method retrieves all data from a disk.

Sammy needs to return to the office to retrieve some antistatic bags and wrist straps before handling digital evidence. Why are these items important for handling digital evidence?

Static electricity doesn't do anything to digital evidence. It's just a precaution.

Static electricity can hurt the user.

Static electricity can make your hair stand up.

Static electricity can destroy digital evidence.

Static electricity can destroy digital evidence.

Kenneth is creating a bit-stream image from a bit-stream copy of an evidence drive, but he's confused as to what the difference is. To Kenneth, there isn't much difference. Please help him out and tell him what makes a bit-stream image different from a bit-stream copy.

A bit-stream image and a bit-copy are identical.

A bit-stream image replicates the evidence drive but is not an exact copy.

There only has to be one bit-stream copy made when working on an image drive.

A bit-stream image creates an exact copy of the evidence disk down to the physical drive level.

A bit-stream image creates an exact copy of the evidence disk down to the physical drive level.

Stella just finished writing a report for Tera Corp. and reviews her report one more time to check the steps she took to be sure her findings are repeatable. The problem is she used a new tool in her findings that has not been vetted by industry experts yet, so it may not adhere to industry standards. Why is this an issue?

New tools that are not vetted may not return repeatable data.

It doesn't change anything.

New tools are used all the time.

It's not important to repeat results.

New tools that are not vetted may not return repeatable data.