Minor procedural missteps are not important provided the overall investigation is properly conducted

Minor procedural missteps are not important provided the overall investigation is properly conducted.

The term forensics relates to the application of ____________ knowledge to ___________ problems.
- legal; computer
- complete; software
- scientific; legal
- familiar; unfamiliar

 

·         scientific; legal

 

What is a message digest?
- It is a hash function that can be used to compare two files to see if they are identical.
- A condensed version of the messages that the computer receives.
- Messages that the computer sends to other computers
- Availability protocol that establishes links to other computers.

 

·         It is a hash function that can be used to compare two files to see if they are identical.

 

What type of evidence is used to aid a jury and may be in the form of a model, experiment, chart, and so on, to indicate that an event occurred?
- Direct evidence
- Real evidence
- Documentary evidence
- Demonstrative evidence

 

·         Demonstrative evidence

 

Which of the following rules applies to evidence obtained in violation of the Fourth Amendment of the Constitution?
- Best evidence rule
- Exclusionary rule
- Hearsay rule
- Evidentiary rule

 

·         Exclusionary rule

 

What is a software bomb?
- A firework that destroys all the disks and CDs in your library
- Any commands executed on the computer that have an adverse effect on the data being investigated
- Screensavers that show fireworks going off
- Software trying to access a computer

 

·         Any commands executed on the computer that have an adverse effect on the data being investigated

 

When taking photographs for use as evidence, what type should be taken?
- Digital camera pictures
- Film with a high speed shutter
- Film with a low speed shutter
- Polaroid

 

·         Polaroid

 

Evidence that is convincing or measures up without question is what standard of evidence?
- Sufficient evidence
- Competent evidence
- Relevant evidence
- Real evidence

 

·         Sufficient evidence

 

Evidence that is material to the case or has bearing on the matter at hand is what standard of evidence?
- Sufficient evidence
- Competent evidence
- Relevant evidence
- Real evidence

 

·         Relevant evidence

 

Tangible objects that prove or disprove fact are what type of evidence?
- Direct evidence
- Real evidence
- Documentary evidence
- Demonstrative evidence

 

·         Real evidence

 

Business records, printouts, and manuals are what type of evidence?
- Direct evidence
- Real evidence
- Documentary evidence
- Demonstrative evidence

 

·         Documentary evidence

 

Evidence offered by a witness that is not based on the personal knowledge of the witness, but is being offered to prove the truth of the matter asserted, fall under which rule of evidence?
- Best evidence rule
- Exclusionary rule
- Hearsay rule
- Relevant evidence rule

 

·         Hearsay rule

 

Clusters that are marked by the operating system as usable is referred to as which of the following?
- Free space
- Slack space
- Open space
- Unused space

 

·         Free space

 

What is the space in a cluster that is not occupied by a file called?
- Free space
- Slack space
- Open space
- Unused space

 

·         Slack space

 

Which of the following has the least volatile data?
- CPU storage
- RAM
- Hard drive
- Kernel tables

 

·         Hard drive

 

Oral testimony that proves a specific fact with no inferences or presumptions is what type of evidence?
- Hearsay
- Real evidence
- Direct evidence
- Demonstrative evidence

 

·         Direct evidence

 

When performing forensics on a computer system you should use the utilities provided by that system.
True or False

 

·         False

 

Only one person is needed to collect and document evidence obtained in performing forensics on a computer system.
True or False

 

·         False

 

When analyzing computer storage components, the original system should be analyzed.
True or False

 

·         False

 

The recycle bin contains all the deleted files on a computer.
True or False

 

·         False

 

Generally speaking, you should back up the computer using DOS instead of Windows.
True or False

 

·         True

 

Relevant evidence must be convincing or measure up without question.
True or False

 

·         False

 

Oral testimony that proves a specific fact is considered real evidence.
True or False

 

·         False

 

Evidence offered by the witness that is not based on the personal knowledge of the witness—but is being offered to prove the truth of the matter asserted—falls under the exclusionary rule.
True or False

 

·         False

 

The space that is left over in a cluster is called slack space.
True or False

 

·         True

·         Minor procedural missteps are not important provided the overall investigation is properly conducted.
True or False

·          

·         False