Course Introduction
Computer Forensics Practice
Questions
Computer Forensics is the study and practice of identifying, preserving, analyzing, and presenting digital evidence in a manner suitable for legal proceedings. The course covers the fundamental principles of forensic science as applied to computers and digital devices, including techniques for data recovery, evidence collection, documentation, and chain of custody. Students learn about file systems, operating systems, and various tools used to investigate cybercrimes such as unauthorized access, data theft, and digital fraud. Legal, ethical, and privacy considerations are also addressed, equipping learners with the skills necessary to support investigations and comply with regulatory requirements in the digital age.
Recommended Textbook
Computer Forensics Principles and Practices 1st Edition by Linda Volonino
Available Study Resources on Quizplus
13 Chapters
600 Verified Questions
600 Flashcards
Source URL: https://quizplus.com/study-set/2159 Page 2
Chapter 1: Forensic Evidence and Crime Investigation
Available Study Resources on Quizplus for this Chatper
33 Verified Questions
33 Flashcards
Source URL: https://quizplus.com/quiz/43035
Sample Questions
Q1) ________ laws protect the public,human life,or private property.
Answer: Criminal
Q2) What piece of legislation makes it a crime to send e-mail using false headers?
A)CAN-SPAM Act
B)CFAA
C)FERPA
D)USA PATRIOT Act
Answer: A
Q3) Which of the following is NOT one of the skills you need as a forensic investigator?
A)Knowledge of legal issues
B)Knowledge of proper investigative techniques
C)Knowledge of computer technology
D)Knowledge of the person's intent
Answer: D
Q4) ________ left by Internet and e-mail usage and digital devices may be the only way to collect enough evidence to solve a crime.
Answer: Cybertrails
Q5) The main reason evidence is ruled ________ is its lack of reliability.
Answer: inadmissible
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Computer Forensics Anddigital Detective Work
Available Study Resources on Quizplus for this Chatper
28 Verified Questions
28 Flashcards
Source URL: https://quizplus.com/quiz/43036
Sample Questions
Q1) The emphasis on computer forensics as a(n)________ is important because it recognizes the field as a discipline with set principles.
Answer: science
Q2) Evidence collected in violation of which amendment will cause the evidence to be excluded?
A)The Fourth Amendment
B)The First Amendment
C)The Ninth Amendment
D)The Tenth Amendment
Answer: A
Q3) Which of the following is NOT considered an objective in ensuring probative information is recovered?
A)To protect the computer system during the actual investigation
B)To search for any and all malware that may have infected the system
C)To recover deleted,existing,hidden,and password protected files
D)To determine if steganography was used
Answer: B
Q4) ________ is the blending of accounting,auditing,and investigative skills. Answer: Forensic accounting
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Tools, Environments, Equipment, and Certifications
Available Study Resources on Quizplus for this Chatper
48 Verified Questions
48 Flashcards
Source URL: https://quizplus.com/quiz/43037
Sample Questions
Q1) A computer forensic specialist may examine the ________ to ascertain the true identity of a file.
Answer: file header
Q2) PDA Seizure
A) Investigates the contents of BlackBerry devices
B) Graphical user interface consists of a series of panes
C) Safely and easily images Mac drives
D) Reads the first 32 bits of a file to identify its type
E) Open-source program that runs on UNIX plattorms
Answer: A
Q3) ________,from Paraben Forensics,is a comprehensive tool for investigating the contents of Palm Pocket PCs that run on Windows CE.
Answer: PDA Seizure
Q4) To protect original data from any alteration,you
A)Use gloves when working with the hard drive
B)Make a forensic copy of the original data
C)Do your forensic work as quickly as possible
D)Use the operating system to copy all relevant files
Answer: B
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Policies and Procedures
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/43038
Sample Questions
Q1) The ________ of a report contains as much detail and documentation as you can include.
Q2) Integrity of the collection process
A)How long will an on-site examination last?
B)Will the investigation cause financial hardships?
C)How volatile is the evidence?
D)Is the equipment impractical?
E)Is this to be done on-site or in the lab?
Q3) Supplementary materials
A)Uses an algorithm to make readable
B)Needs a word or phrase to unlock the file
C)Data hides in another file
D)Usually mail files
Q4) First
A)Transport the evidence to the lab
B)Tag the evidence
C)Bag the evidence
D)Document the evidence
Q5) The ________ determines which of the computer's media is used to start the computer.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Data, PDA, and Cell Phone Forensics
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/43039
Sample Questions
Q1) User data is kept in the ________ section of a PDA.
Q2) RAM data in PDAs can be kept intact through which of the following means?
A)Nonerasable ROM
B)Self-refresh circuitry
C)Batteries
D)Capacitors
Q3) Logicube
A)Considered to be the gold standard
B)Highly regarded and able to generate detailed reports
C)Considered most reliable for hardware
D)Has Faraday bags
Q4) In addition to a SIM,most cell phones have a(n)
A)AIM
B)PIM
C)PUK
D)SMS
Q5) ________ is the most widely used hard drive technology.
Q6) To gain access to a protected SIM,you may need to ask the service provider for a(n)________.
Q7) New cellular phones are basically low-end _______.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Operating Systems and Data Transmission
Basics for Digital Investigations
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/43040
Sample Questions
Q1) Memory management deals with
A)Saving and archiving data
B)Task scheduling
C)Temporary storage or use of applications and data
D)All of the above
Q2) In data transfer,only the ________ changes from router or switch to the next one in line.
Q3) ________ is the method of travel whereby data is sent via multiple paths to its final destination.
Q4) ________ is a single-user,single-tasking operating system.
Q5) Presentation
A)Translates logical to physical addresses
B)Creates and maintains the communications link
C)Performs protocol conversion
D)Transmits raw data
Q6) The set of rules that govern how commands are entered into DOS is called ________.
8
Q7) The function of ________ within an operating system is the same as a traffic light regulating the flow of traffic at an intersection.
To view all questions and flashcards with answers, click on the resource link above.
Chapter 7: Investigating Windows, linux, and Graphic Files
Available Study Resources on Quizplus for this Chatper
57 Verified Questions
57 Flashcards
Source URL: https://quizplus.com/quiz/43041
Sample Questions
Q1) The ________ tracks those actions deemed as events by the software application.
Q2) One application of metadata used by Windows is an uncommon storage concept called ________.
Q3) The ________ folder is used by Internet sites to store information about the user.
Q4) Superblock
A)Contain metadata for each file
B)Unit of allocation for storage
C)Created for every file system mounted
D)Contains information about the directory structure
Q5) *
A)Used to match the ASCII hexadecimal representation of a single character
B)Implements an OR situation
C)When placed after a character, matches any number of occurrences of that character
D)Matches a single character
Q6) ________ are used to determine where data starts and ends when graphic files are located in unallocated or slack space.
Q7) The ________ subfolder lists the files that the user has accessed over several time periods.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: E-Mail and Webmail Forensics
Available Study Resources on Quizplus for this Chatper
47 Verified Questions
47 Flashcards
Source URL: https://quizplus.com/quiz/43042
Sample Questions
Q1) E-mail attachments can be found within slack space by searching for
A)The keyword base64
B)The keyword base32
C)The keyword base16
D)The keyword base8
Q2) What portion of an e-mail records such information as the identity of the creator?
A)The trailer
B)The body
C)The header
D)None of these
Q3) The tool often used for quick communications without resorting to e-mail is________ .
Q4) Which of the following file extensions would most likely be found in an e-mail search for someone using Outlook?
A).eml
B).wab
C).dbx
D).mbx
Q5) A check of the ________ will determine how long a company keeps e-mails.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Internet and Network Forensics and Intrusion Detection
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43043
Sample Questions
Q1) NFAT systems generally require large amounts of storage space,such as a(n)________ system.
Q2) Hub
A)Repeats any and all data
B)Duplicates data on any port and forwards it to the NFAT
C)Transmits and receives RF
D)Used like a cable splice
Q3) Network layer
A)Permits FTP or HTTP protocols
B)Acts like an IP filter
C)Acts as a mediator
Q4) Examiner computer
A)Where the analysis is performed
B)Contains a large database
C)Modules installed on hosts
Q5) A(n)________ repeats all data received on any port to the remaining ports;it is gradually being replaced by switches and SPAN systems.
Q6) ________ transmit and receive data via radio frequency in the open.
Q7) A(n)________ is the standard operation procedures of the network when it is running normally. Page 11
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Tracking Down Those Who Intend to Do Harm
on a Large Scale
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43044
Sample Questions
Q1) alneda.com
A)Alleged to have flashed pictures of persecuted Muslims
B)Designed to teach users to conduct attacks
C)Used by jihad in Afghanistan
D)Featured international news on al Qaeda
Q2) Detecting and investigating criminal hacker cases require investigators to
A)Take steps to stop attacks
B)Understand the vocabulary
C)Have the latest hacker tools
D)All are necessary
Q3) What bank was found to be hosting an attack unknowingly against another?
A)Unipol Internationale
B)Chase Manhattan
C)China Construction Bank
D)Thailand First
Q4) Anonymity,control resources,and many other features make the ________ the criminals' conduit for coordinating and carrying out an agenda.
Q5) ________ logs help track down criminals because they hold evidence that a crime has been committed and where the intrusion occurred.
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 11: Fraud and Forensic Accounting Investigation
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/43045
Sample Questions
Q1) An essential element of fraud is
A)Intent
B)Lying about facts
C)Concealment
D)Misrepresentation of truth
Q2) With a forensic accounting investigation,there is a presumption of ________.
Q3) Which of the following is one of the purposes for a forensic fraud investigation?
A)Revision of an organization's earnings statements
B)Dispute analysis or litigation
C)Reduction of pressure on employees
D)Pursuit of hackers
Q4) The term ________ means mental state or "guilty mind."
Q5) Which of the following is NOT considered a way to commit fraud for a company?
A)Accounting cycle fraud
B)Bribery
C)Senior management financial reporting fraud
D)Extortion
Q6) The law of ________ holds that some information is protected by law from being released.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 12: Federal Rules and Criminal Codes
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/43046
Sample Questions
Q1) Federal rules and laws are changed
A)To keep up with political policies
B)To help explain the differences in physical and cyberlaws
C)To help govern regulations
D)To keep up with new technology
Q2) What amendment must a law enforcement office check before seizing hardware or computers?
A)The Fourth Amendment
B)The Sixth Amendment
C)The Eighth Amendment
D)The Tenth Amendment
Q3) If records obtained by wiretap are not turned over to a judge in a reasonable amount of time,the records are
A)Still admissible
B)Sealed until the trial
C)Turned over to the subject of the wiretap or his legal representative
D)Inadmissible
Q4) Evidence has ________ value if it is sufficiently useful to prove something important.
Q5) The Frye test that Rule 702 relied upon was replaced with the ________ test.
Page 15
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Ethical and Professional Responsibility in Testimony
Available Study Resources on Quizplus for this Chatper
30 Verified Questions
30 Flashcards
Source URL: https://quizplus.com/quiz/43047
Sample Questions
Q1) Opposing counsel will do their best to ________ or discredit your testimony.
Q2) It is the ________ who ultimately decide the weight and credibility of the evidence.
Q3) A common trap used by lawyers is to ask you to offer opinions outside ________.
Q4) As an expert witness,what should you NOT do while in court?
A)Be patient.
B)Try to be relaxed and look at the jury when answering.
C)Be truthful,careful,and precise.
D)Dress casually and comfortably.
Q5) The _______ was designed to encourage witnesses to testify freely and honestly without fear of lawsuits arising from their testimony.
Q6) As an expert witness,you are being paid for all the following EXCEPT
A)Your expertise
B)Your ability to prove guilt
C)Your time
D)Your expert view
Q7) A witness who will testify in a trial is called a(n)________ witness.
Page 16
Q8) ________ is also used to examine jurors to make sure they are fair and impartial.
Q9) ________ are done out of court but under the same oath as in court.
To view all questions and flashcards with answers, click on the resource link above.
Page 17