Cengage Chapter 4 - Processing Crime and Incident Scenes

Question 1

A computerized system for identifying fingerprints that’s connected to a central database; used to identify criminal suspects and review thousands of fingerprint samples at high speed.

Answer 1

Automated Fingerprint Identification System (AFIS)

Question 2

Data generated by a computer, such as system log files or proxy server logs.

Answer 2

computer-generated records

Question 3

Digital files generated by a person, such as electronic spreadsheets.

Answer 3

computer-stored records

Question 4

Observing people or places without being detected, often by using electronic equipment, such as video cameras or keystroke/screen capture programs.

Answer 4

covert surveillance

Question 5

A mathematical algorithm that translates a file into a unique hexadecimal value.

Answer 5

Cyclic Redundancy Check (CRC)

Question 6

Evidence consisting of information stored or transmitted in electronic form.

Answer 6

digital evidence

Question 7

A portable kit designed to process several computers and a variety of operating systems at a crime or incident scene involving computers. This kit should contain two or more types of software or hardware forensics tools, such as extra storage drives.

Answer 7

extensive-response field kit

Question 8

A unique hexadecimal value that identifies a file or drive.

Answer 8

hash value

Question 9

Chemical, biological, or radiological substances that can cause harm to people.

Answer 9

hazardous materials (HAZMAT)

Question 10

A portable kit containing only the minimum tools needed to perform disk acquisitions and preliminary forensics analysis in the field.

Answer 10

initial-response field kit

Question 11

Data that doesn’t contribute to evidence of a crime or violation.

Answer 11

innocent information

Question 12

A value created by an encryption utility’s secret key.

Answer 12

keyed hash set

Question 13

Wording in a search warrant that limits the scope of a search for evidence.

Answer 13

limiting phrase

Question 14

Private-sector cases that require less investigative effort than a major criminal case.

Answer 14

low-level investigations

Question 15

An algorithm that produces a hexadecimal value of a file or storage media. Used to determine whether data has been changed.

Answer 15

Message Digest 5 (MD5)

Question 16

One of the governing bodies responsible for setting standards for some U.S. industries.

Answer 16

National Institute of Standards and Technology (NIST)

Question 17

A unique hash number generated by a software tool and used to identify files.

Answer 17

nonkeyed hash set

Question 18

Someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.

Answer 18

person of interest

Question 19

When conducting a search and seizure, objects in plain view of a law enforcement officer, who has the right to be in position to have that view, are subject to seizure without a warrant and can be introduced as evidence. Applied to conducting searches of computers, the plain view doctrine’s limitations are less clear.

Answer 19

plain view doctrine

Question 20

The standard specifying whether a police officer has the right to make an arrest, conduct a personal or property search, or obtain a warrant for arrest.

Answer 20

probable cause

Question 21

The motivation for law enforcement and other professional personnel to examine an incident or crime scene to see what happened.

Answer 21

professional curiosity

Question 22

A group that sets standards for recovering, preserving, and examining digital evidence.

Answer 22

Scientific Working Group on Digital Evidence (SWGDE)

Question 23

A forensic hashing algorithm created by NIST to determine whether data in a file or on storage media has been altered. See also National Institute of Standards and Technology (NIST).

Answer 23

Secure Hash Algorithm version 1 (SHA-1)

Question 24

Detecting data transmissions to and from a suspect’s computer and a network server to determine the type of data being transmitted over a network.

Answer 24

sniffing