Digital Evidence Analysis
Test Preparation
Course Introduction
Digital Evidence Analysis is an essential course that introduces students to the principles and practices of identifying, collecting, preserving, and analyzing digital evidence in the context of criminal and civil investigations. Covering topics such as forensic imaging, data recovery, file system analysis, and the legal aspects of handling digital artifacts, the course emphasizes methodical examination techniques for computers, mobile devices, and network sources. Students gain hands-on experience with industry-standard forensic tools and software, learning to interpret digital traces, authenticate evidence, and prepare technical reports that adhere to legal standards and can withstand courtroom scrutiny.
Recommended Textbook
Computer Forensics Principles and Practices 1st Edition by Linda Volonino
Available Study Resources on Quizplus
13 Chapters
600 Verified Questions
600 Flashcards
Source URL: https://quizplus.com/study-set/2159 Page 2
Chapter 1: Forensic Evidence and Crime Investigation
Available Study Resources on Quizplus for this Chatper
33 Verified Questions
33 Flashcards
Source URL: https://quizplus.com/quiz/43035
Sample Questions
Q1) Crimes against computers can include which of the following?
A)Attacks on networks
B)Unauthorized access
C)Tampering with data
D)All the above
Answer: D
Q2) The starting point for understanding all types of forensics investigations is
A)Knowledge of all pertaining laws and regulations
B)The investigative techniques
C)The psychological profile of the defendant
D)The evidence
Answer: D
Q3) Which of the following has the most far-reaching effect for law enforcement concerning cybercrimes?
A)FERPA
B)CFAA
C)CAN-SPAM Act
D)USA PATRIOT Act
Answer: D
To view all questions and flashcards with answers, click on the resource link above.
Page 3
Chapter 2: Computer Forensics Anddigital Detective Work
Available Study Resources on Quizplus for this Chatper
28 Verified Questions
28 Flashcards
Source URL: https://quizplus.com/quiz/43036
Sample Questions
Q1) Criminals whose purpose is ________ need to brag about their exploits because they are motivated by a desire for fame or notoriety.
Answer: trophy hunting
Q2) What unique piece of evidence finally gave police the break they'd needed in order to solve the BTK serial murderer case?
A)A phone number located within a computer
B)A USB drive with his deleted address
C)A floppy disk with his deleted address
D)A floppy disk with a deleted address of a church
Answer: D
Q3) ________ is created when a file is created if it does not take up an entire sector.
Answer: File slack
Q4) What type of program is available to delete and overwrite data on a computer?
A)File-overwriting software
B)File-deleting software
C)File-wiping software
D)All of the above
Answer: C
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Tools, Environments, Equipment, and Certifications
Available Study Resources on Quizplus for this Chatper
48 Verified Questions
48 Flashcards
Source URL: https://quizplus.com/quiz/43037
Sample Questions
Q1) Write blocker
A) Unique digital signature of data
B) Additional sectors created to fill a cluster
C) Application that prevents changes to a hard drive
D) Captures a "snapshot" of everything on the drive
E) Mathematical computations that validate a copy
Answer: C
Q2) When a copy is made,the contents of a hard drive are stored as a series of compressed ________ files.
Answer: image
Q3) MacQuisition Boot CD
A) Investigates the contents of BlackBerry devices
B) Graphical user interface consists of a series of panes
C) Safely and easily images Mac drives
D) Reads the first 32 bits of a file to identify its type
E) Open-source program that runs on UNIX plattorms
Answer: C
Q4) A forensics lab is typically considered to be a(n)________ environment.
Answer: trusted
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Policies and Procedures
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/43038
Sample Questions
Q1) Fourth
A)Transport the evidence to the lab
B)Tag the evidence
C)Bag the evidence
D)Document the evidence
Q2) Why is tagging books and magazines at a crime scene considered important?
A)You might wish to subscribe to a few yourself.
B)It isn't important.
C)It allows the investigator to get to know how the person thinks.
D)You might find passwords hidden in the articles.
Q3) The ________ of the extraction model is primarily concerned with developing a picture of how the system is set up.
Q4) Which of the following is NOT one of the areas to be considered when selecting members of a forensic unit?
A)Experience
B)Team player
C)Mental agility
D)Works well under pressure
Q5) With the original evidence safely stored,you should make a(n)________ of the forensic image.
6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Data, PDA, and Cell Phone Forensics
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/43039
Sample Questions
Q1) To understand how hardware works,you must understand the ________ of how drives store 0s and 1s.
Q2) Most PDA memory is constructed of which type of memory?
A)Permanent RAM
B)Permanent ROM
C)Flash-type RAM
D)Flash-type ROM
Q3) One of the most important tasks you must do when working with a hard drive is to
A)Perform a live analysis whenever possible
B)Prevent the hard drive from booting when you restart it to make the data transfer
C)Make sure you are working with the original data
D)Secure a password cracker in case you encounter protected files
Q4) EIDE
A)Allows up to four ATA devices
B)Allows a CD to use ATA connections
C)The umbrella standard
D)The standard is no longer used
Q5) The simple rule for powering down equipment is that you pull the plug on everything but ________.
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Operating Systems and Data Transmission
Basics for Digital Investigations
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/43040
Sample Questions
Q1) Which of the following is considered to be the first stable GUI operating system?
A)Windows 3.0
B)Windows 3.1
C)Windows 3.11
D)Windows 95
Q2) Layer 5
A)Application
B)Session
C)Data Link
D)Transport
Q3) Physical
A)Translates logical to physical addresses
B)Creates and maintains the communications link
C)Performs protocol conversion
D)Transmits raw data
Q4) The set of rules that govern how commands are entered into DOS is called
Q5) The original MS-DOS FAT system is now referred to as ________.
Q6) The user interface is also known as a(n)________.
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Investigating Windows, linux, and Graphic Files
Available Study Resources on Quizplus for this Chatper
57 Verified Questions
57 Flashcards
Source URL: https://quizplus.com/quiz/43041
Sample Questions
Q1) HKEY_CURRENT_CONFIG
A)Default
B)System
C)SAM
D)Software
Q2) Clues that may indicate stego use include all of the following EXCEPT
A)The sophistication of the computer's owner
B)Software clues on the computer
C)Type of crime being investigated
D)Large number of files in the Recycle Bin
Q3) 42 4D
A)BMP
B)ICO
C)PNG
D)JPEG
Q4) Which of the following is the primary default folder in Windows 2000 and XP?
A)Documents and Settings
B)My Documents
C)User Root
D)My Computer
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: E-Mail and Webmail Forensics
Available Study Resources on Quizplus for this Chatper
47 Verified Questions
47 Flashcards
Source URL: https://quizplus.com/quiz/43042
Sample Questions
Q1) Fourth step
A)Server sends e-mail to final destination
B)Client sends copy of e-mail to server
C)User logs onto her e-mail account
D)User initiates a send session via port 25
Q2) ________ uses two or more hard drives accessed in parallel to create a pool of storage.
Q3) Which of the following file extensions would most likely be found in an e-mail search for someone using Outlook?
A).eml
B).wab
C).dbx
D).mbx
Q4) .box
A)OE fax page
B)Lotus Notes mailbox
C)Eudora message base
D)AOL organizer file
Q5) E-mail software is a(n)________ program that works in concert with a(n)________.
Q6) The ________ comes before the @ sign in an e-mail address
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Internet and Network Forensics and Intrusion Detection
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43043
Sample Questions
Q1) What is designed to collect data straight from the network media?
A)Packet analyzers
B)Packet sniffers
C)Packet sifters
D)Packet lifters
Q2) A(n)________ is the standard operation procedures of the network when it is running normally.
Q3) The newest NFAT systems are a combination of
A)IDS and application software
B)IDS and forensic software
C)Agents and application software
D)DHCP servers and IDSs
Q4) NFAT systems generally require large amounts of storage space,such as a(n)________ system.
Q5) Using an NFAT system,an event or security breach can be
A)Detected
B)Monitored
C)Traced in real-time
D)All are correct
Q6) ________ transmit and receive data via radio frequency in the open. Page 11
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Tracking Down Those Who Intend to Do Harm
on a Large Scale
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43044
Sample Questions
Q1) Which of the following was NOT e-evidence used to track the creator of the Melissa virus?
A)Hardware ID
B)Operating system event log
C)AOL return address
D)Key signature in e-mails from the perpetrator
Q2) Anonymity,control resources,and many other features make the ________ the criminals' conduit for coordinating and carrying out an agenda.
Q3) Fourth
A)A spammer (or criminal) buys access to the botnet from the botmaster
B)The botmaster or spammer sends instructions to the infected PCs using the IRC server, which triggers them to send out spam messages to other servers
C)A botmaster sends out viruses to infect computers
D)Infected PCs follow instructions to log in to an IRC server
Q4) Nimda
A)\( \$ 3.2 \) billion
B)\( \$ 1.15 \) billion
C)\( \$ 2.62 \) billion
D)\( \$ 635 \) million
Page 13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Fraud and Forensic Accounting Investigation
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/43045
Sample Questions
Q1) Fraud is a crime that is carried out using ________ instead of a weapon.
Q2) San Diego city employees
A)Involved a $ 1.4 billion pension deficit
B)Employees received 34 months jail sentence for illegally gained company stock
C)Incriminating e-mail revealed senior management perpetrated fraud and received inflated bonuses
D)Database administrator copied employee information and attempted to sell it over the Internet
Q3) ________ fraud is the deliberate misuse of an organization's resources for the goal of personal enrichment.
Q4) Fraud is more likely to occur when someone feels ________ to commit fraud.
Q5) Which of the following is NOT one of the ways that fraud investigations originate?
A)From internal audits
B)From anonymous tips
C)From the FBI
D)From complaints by customers or vendors
Q6) The term ________ means mental state or "guilty mind."
Q7) _____ is defined as obtaining property from another by use of threatened force or fear.
Page 14
To view all questions and flashcards with answers, click on the resource link above.
Chapter 12: Federal Rules and Criminal Codes
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/43046
Sample Questions
Q1) Wiretap
A)When hijackings are suspected
B)Used to collect noncontent traffic
C)Creates a paper tape record of outgoing calls
D)Used when the information likely to be obtained is relevant to an ongoing criminal investigation
Q2) Authentication
A)Qualified experts may testify though not eyewitnesses
B)The evidence is valuable to an issue of the case
C)Keeps private attorney-client communications
D)The evidence is what it claims to be
E)Ruling against "out of court" statements
Q3) Hearsay
A)Qualified experts may testify though not eyewitnesses
B)The evidence is valuable to an issue of the case
C)Keeps private attorney-client communications
D)The evidence is what it claims to be
E)Ruling against "out of court" statements
Q4) The ________ is a mechanical device that can be attached to a specific telephone line at a telephone office.
15
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Ethical and Professional Responsibility in Testimony
Available Study Resources on Quizplus for this Chatper
30 Verified Questions
30 Flashcards
Source URL: https://quizplus.com/quiz/43047
Sample Questions
Q1) ________ is also used to examine jurors to make sure they are fair and impartial.
Q2) A(n)________ contains a complete statement of all opinions to be expressed and the basis and reasons for those opinions.
Q3) ________ are done out of court but under the same oath as in court.
Q4) Which of the following is NOT considered a part of an expert witness report?
A)Description of the facts
B)Materials not available for review
C)Findings
D)Background
Q5) To impeach one's credibility a lawyer may attack all of the following EXCEPT
A)Your physical abilities
B)Your credentials
C)Your methods
D)Your written and/or verbal statements
Q6) As an expert witness,what should you NOT do while in court?
A)Be patient.
B)Try to be relaxed and look at the jury when answering.
C)Be truthful,careful,and precise.
D)Dress casually and comfortably.
To view all questions and flashcards with answers, click on the resource link above. Page 16