Cybercrime Investigation Exam Review
Course Introduction
Cybercrime Investigation explores the principles, methods, and tools essential for investigating crimes committed using digital technologies and networks. The course covers a broad range of topics including the legal framework for cybercrime investigations, digital evidence collection and preservation, forensic methodologies, and the challenges associated with investigating offenses such as hacking, identity theft, cyberstalking, and online fraud. Students will analyze case studies, examine investigative procedures, and participate in simulated exercises to develop practical skills in tracking perpetrators, ensuring evidence integrity, and collaborating with law enforcement agencies. The course also addresses emerging trends in cybercrime and the evolving strategies used to combat digital threats responsibly and ethically.
Recommended Textbook
Guide to Computer Forensics and Investigations 4th Edition by Bill Nelson
Available Study Resources on Quizplus
16 Chapters
768 Verified Questions
768 Flashcards
Source URL: https://quizplus.com/study-set/1690 Page 2
Chapter 1: Computer Forensics and Investigations As a Profession
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33478
Sample Questions
Q1) After a judge approves and signs a search warrant, it's ready to be executed, meaning you can collect evidence as defined by the warrant.
A)True
B)False
Answer: True
Q2) The ____________________ provides a record of clues to crimes that have been committed previously.
Answer: police blotter
Q3) involves selling sensitive or confidential company information to a competitor
A)Computer forensics
B)Network forensics
C)Litigation
D)Xtree Gold
E)Case law
F)HTCIA
G)Affidavit
H)Industrial espionage
I)Line of authority
Answer: H
Page 3
To view all questions and flashcards with answers, click on the resource link above.
Chapter 2: Understanding Computer Investigations
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33479
Sample Questions
Q1) ____ investigations typically include spam, inappropriate and offensive message content, and harassment or threats.
A) VPN
B) Internet
C) E-mail
D) Phone
Answer: C
Q2) To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as a ____.
A) mobile workstation
B) forensic workstation
C) forensic lab
D) recovery workstation
Answer: B
Q3) A bit-stream copy is a bit-by-bit duplicate of the original disk. You should use the original disk whenever possible.
A)True
B)False
Answer: False
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: The Investigators Office and Laboratory
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33480
Sample Questions
Q1) What are the duties of a lab manager?
Answer: The lab manager sets up the processes for managing cases and reviews these procedures regularly.Besides performing general management tasks, such as promoting group consensus in decision making, maintaining fiscal responsibility for lab needs, and encouraging honesty among staff members, the lab manager plans updates for the lab, such as new hardware and software purchases. The lab manager also establishes and promotes quality-assurance processes for the lab's staff to use, such as what to do when a case arrives, including logging evidence, specifying who can enter the lab, and establishing guidelines for filing reports.To ensure the lab's efficiency, the lab manager also sets reasonable production schedules for processing work.
Q2) For labs using high-end ____ servers (such as Digital Intelligence F.R.E.D.C. or F.R.E.D.M.), you must consider methods for restoring large data sets.
A) RAID
B) ISDN
C) WAN
D) TEMPEST
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Data Acquisition
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33481
Sample Questions
Q1) process of copying data
A)SafeBack
B)WinZip
C)Data acquisition
D)AFF
E)IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase
Q2) What are the requirements for acquiring data on a suspect computer using Linux?
Q3) The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.
A) fdisk
B) dd
C) man
D) raw
Q4) There are two types of acquisitions: static acquisitions and ____________________ acquisitions.
Q5) What are some of the features offered by proprietary data acquisition formats?
Page 6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Processing Crime and Incident Scenes
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33482
Sample Questions
Q1) Private-sector organizations include businesses and _________________________ that aren't involved in law enforcement.
Q2) Law enforcement investigators need a(n) ____ to remove computers from a crime scene and transport them to a lab.
A) evidence custody form
B) FOIA form
C) affidavit
D) warrant
Q3) Most federal courts have interpreted computer records as ____ evidence.
A) conclusive
B) regular
C) hearsay
D) direct
Q4) Evidence is commonly lost or corrupted through ____, which involves police officers and other professionals who aren't part of the crime scene processing team.
A) onlookers
B) HAZMAT teams
C) FOIA laws
D) professional curiosity
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Working With Windows and Dos Systems
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33483
Sample Questions
Q1) A ____ is a column of tracks on two or more disk platters.
A) cylinder
B) sector
C) track
D) head
Q2) Describe some of the open source whole disk encryption tools.
Q3) ____, located in the root folder of the system partition, specifies the Windows XP path installation and contains options for selecting the Windows version.
A) Boot.ini
B) BootSec.dos
C) NTDetect.com
D) NTBootdd.sys
Q4) The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there's a problem with the user's original private key.
A) certificate escrow
B) recovery certificate
C) administrator certificate
D) root certificate
Q5) Summarize the evolution of FAT versions.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Current Computer Forensics Tools
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33484
Sample Questions
Q1) Because there are a number of different versions of UNIX and Linux, these platforms are referred to as ____________________ platforms.
Q2) To make a disk acquisition with En.exe requires only a PC running ____ with a 12-volt power connector and an IDE, a SATA, or a SCSI connector cable.
A) UNIX
B) MAC OS X
C) Linux
D) MS-DOS
Q3) Explain the validation of evidence data process.
Q4) Many vendors have developed write-blocking devices that connect to a computer through FireWire,____ 2.0,and SCSI controllers.
A) USB
B) IDE
C) LCD
D) PCMCIA
Q5) Briefly explain the purpose of the NIST NSRL project.
Q6) Describe some of the problems you may encounter if you decide to build your own forensics workstation.
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Macintosh and Linux Boot Processes and File Systems
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33485
Sample Questions
Q1) IDE ATA controller on an old 486 PC doesn't recognize disk drives larger than 8.4
A) KB
B) MB
C) GB
D) TB
Q2) What is a bad block inode on Linux?
Q3) the list command on Linux
A)File Manager
B)Inode blocks
C)ISO 9660
D)LILO
E)Clumps
F)Volume
G)ls
H)Catalog
I)Finder
Q4) Explain the use of B*-trees on Mac OS 9 file system.
Page 10
Q5) Explain the use of forensic tools for Macintosh systems.
Q6) Write a brief history of SCSI.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Computer Forensics Analysis and Validation
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33486
Sample Questions
Q1) FTK provides two options for searching for keywords: indexed search and ____________________ search.
Q2) limit a civil investigation
A)Court orders for discovery
B)Investigation plan
C)Digital Intelligence PDWipe
D)Live search
E)Cabinet
F)PRTK
G)Validating digital evidence
H)MD5
I)System Commander
Q3) Data ____ involves changing or manipulating a file to conceal information.
A) recovery
B) creep
C) integrity
D) hiding
Q4) How should you approach a case in which an employee is suspected of industrial espionage?
Q5) What are the file systems supported by FTK for forensic analysis?
Page 12
To view all questions and flashcards with answers, click on the resource link above.
Chapter 10: Recovering Graphics Files
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33487
Sample Questions
Q1) All ____________________ files start at position zero (offset 0 is the first byte of a file) with hexadecimal 49 49 2A.
Q2) Explain how lossless compression relates to image file formats.
Q3) If a graphics file is fragmented across areas on a disk, first you must recover all the fragments to re-create the file.
A)True
B)False
Q4) Gnome graphics editor
A)Pixels
B)Hex Workshop
C)Adobe Illustrator
D)Microsoft Office Picture Manager
E)JPEG
F)Steganalysis tools
G)GIMP
H)XIF
I)Metafile graphics
Q5) The two major forms of steganography are ____________________ and substitution.
Q6) Write a brief history of steganography.
Q7) Explain how steganalysis tools work.
13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Virtual Machines, Network Forensics, and Live Acquisitions
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33488
Sample Questions
Q1) A common way of examining network traffic is by running the ____ program.
A) Netdump
B) Slackdump
C) Coredump
D) Tcpdump
Q2) displays who's logged on locally
A)Cyberforensics
B)Ethereal
C)Tripwire
D)PsGetSid
E)PsLoggedOn
F)Trojan horse
G)Knoppix
H)PsShutdown
I)oinkmaster
Q3) Ngrep cannot be used to examine e-mail headers or IRC chats.
A)True
B)False
Q4) What is Knoppix-STD?
Q5) What are some of the tools included with Knoppix STD?
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 12: E-Mail Investigations
Available Study Resources on Quizplus for this Chatper
48 Verified Questions
48 Flashcards
Source URL: https://quizplus.com/quiz/33489
Sample Questions
Q1) In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk.
A) tracking
B) checkpoint
C) temporary
D) milestone
Q2) To view AOL e-mail headers click Action, ____ from the menu.
A) More options
B) Message properties
C) Options
D) View Message Source
Q3) Like UNIX e-mail servers, Exchange maintains logs to track e-mail communication.
A)True
B)False
Q4) GroupWise has ____ ways of organizing the mailboxes on the server.
A) 2
B) 3
C) 4
D) 5
To view all questions and flashcards with answers, click on the resource link above. Page 15
Chapter 13: Cell Phone and Mobile Device Forensics
Available Study Resources on Quizplus for this Chatper
37 Verified Questions
37 Flashcards
Source URL: https://quizplus.com/quiz/33490
Sample Questions
Q1) Identify and define three kinds of peripheral memory cards used with PDAs.
Q2) one of the most common digital networks, it uses the full radio frequency spectrum to define channels
A)CDMA
B)iDEN
C)EDGE
D)ROM
Q3) How can you isolate a mobile device from incoming signals?
Q4) Most Code Division Multiple Access (CDMA) networks conform to IS-95, created by the ______________________.
Q5) Portability of information is what makes SIM cards so versatile.
A)True
B)False
Q6) The file system for a SIM card is a ____ structure.
A) volatile
B) circular
C) hierarchical
D) linear
Q7) What are the three main components used for cell phone communications?
To view all questions and flashcards with answers, click on the resource link above. Page 16
Q8) What is the general procedure to access the content on a mobile phone SIM card?
Chapter 14: Report Writing for High-Tech Investigations
Available Study Resources on Quizplus for this Chatper
48 Verified Questions
48 Flashcards
Source URL: https://quizplus.com/quiz/33491
Sample Questions
Q1) A written preliminary report is considered a ____ document because opposing counsel can demand discovery on it.
A) low-risk
B) middle-risk
C) high-risk
D) no-risk
Q2) used by an attorney to guide an expert witness in his or her testimony
A)Decimal numbering
B)Lay witness
C)FTK
D)Examination plan
E)Signposts
F)Verbal report
G)Spoliation
H)Conclusion section
I)MD5
Q3) What do you need to consider to produce clear, concise reports?
Q4) _________________________ assist readers in scanning the text quickly by highlighting the main points and logical development of information.
To view all questions and flashcards with answers, click on the resource link above. Page 17
Chapter 15: Expert Testimony in High-Tech Investigations
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/33492
Sample Questions
Q1) provide an overview of the case during a trial
A)Plaintiff
B)Motion in limine
C)Voir dire of venireman
D)Opening statements
E)Discovery deposition
F)CV
G)Testimony preservation deposition
H)Voir dire
I)MD5
Q2) Regarding a trial, the term ____ means rejecting potential jurors.
A) voir dire
B) rebuttal
C) strikes
D) venireman
Q3) What are some of the reasons to avoid contact with news media during a case?
Q4) Depending on your attorney's needs, you might provide only your opinion and technical expertise to him or her instead of testifying in court; this role is called a(n)
Q5) Briefly describe judicial hearings.
To view all questions and flashcards with answers, click on the resource link above. Page 18
Chapter 16: Ethics for the Expert Witness
Available Study Resources on Quizplus for this Chatper
35 Verified Questions
35 Flashcards
Source URL: https://quizplus.com/quiz/33493
Sample Questions
Q1) Some attorneys contact many experts as a ploy to disqualify them or prevent opposing counsel from hiring them; this practice is called "____________________."
Q2) ____ are the experts who testify most often.
A) Civil engineers
B) Computer forensics experts
C) Chemical engineers
D) Medical professionals
Q3) What are some of the factors courts have used in determining whether to disqualify an expert?
Q4) What are some of the requirements included in the HTCIA core values?
Q5) Briefly describe the issues related to an attorney's "opinion shopping."
Q6) help you maintain your self-respect and the respect of your profession
A)Ethics
B)Federal Rules of Evidence (FRE)
C)Disqualification
D)IACIS
Q7) The ____________________ is the foundation of medical ethics.
Q8) _____________________ are the rules you internalize and use to measure your performance.
To view all questions and flashcards with answers, click on the resource link above. Page 19