IS3350 CHAPTER 15 Flashcards
Documentation that shows how evidence is collected, used, and handled throughout the lifetime of a case is called ___?
This document shows who obtained evidence, where and when it was obtained, who secured it, and who had control or possession of it.
CHAIN OF CUSTODY
A category of computer forensics that focuses on examining programming code for malicious code or signatures is called ___?
It is also know as malware forensics.
CODE OF ANALYSIS
The scientific process of collecting and examining data that is stored on or received or transmitted by an electronic device is called ___?
It is also called system forensics, digital forensics, computer forensic analysis, computer examination, data recovery, or inforensics.
COMPUTER FORENSICS
Evidence collected from an electronic device is called ___?
DIGITAL EVIDENCE
An exact copy of an electronic media storage device is called ___?
A bit-by-bit copy includes deleted files, slack space, and areas of the storage device that a normal file copy would not include.
FORENSIC DUPLICATE IMAGE
A legal doctrine that states that evidence that isn’t gathered evidence can’t be used in court is called ___?
Any subsequent evidence gathered as a result of the illegally obtained evidence can’t be used in court either.
FRUIT OF THE POISONOUS TREE DOCTRINE
Any out-of-court statement made by a person that is offered to prove some issue in a case is called ___?
Gossip is a common example.
HEARSAY
A basic assumption in forensics science that states that people always leave traces of their activities when they interact with other people or with other objects is called ___?
LOCARD’S EXCHANGE PRINCIPLE
A category of computer forensics that focuses on collecting and examining data stored on physical media is called ___?
MEDIA ANALYSIS
A category of computer forensics that focuses on capturing and examining network traffic is called ___?
It includes reviewing transaction logs and using real time monitoring to identify and locate evidence.
NETWORK ANALYSIS
A warning banner that provides notice of legal rights to users of computer networks is called ___?
The are generally displayed as a computer user logs into a network or on an entity’s home page.
NETWORK BANNER
A formal protest made by an attorney to a trial court judge is called ___?
An attorney usually makes this if the opposing party is asking questions or submitting evidence that is inappropriate or violates a trial court rule.
OBJECTION
Devices that monitor outgoing transmission data is called ___?
They record dialing, routing, signaling, or address information.
PEN REGISTER DEVICES
Data that is sorted on a hard drive or other storage media is called ___?
It is preserved when an electronic device is turned off.
PERSISTENT DATA
Evidence that proves or disproves a legal element in a case is called ___?
If evidence isn’t this, then it can be excluded from a trial.
Also known as relevant evidence.
PROBATIVE EVIDENCE
Devices that monitor incoming transmission data is called ___?
They capture incoming electronic signals that identify the originating transmission data.
TRAP AND TRACE DEVICES
Data that is sorted in the memory of an electronic device is called ___?
It is lost when an electronic device is turned off.
VOLATILE DATA
- A system back-up copy is considered a forensic duplicate image.
TRUE OR FALSE
FALSE
- What is an exception to the Fourth Amendment’s search warrant requirement?
- Consent
- Plain view doctrine
- Inventory search
- All the above
- None of the above
Consent
Plain view doctrine
Inventory search
All the above
- Which principle is a basic assumption of forensic science?
- The silver platter doctrine
- Exigent circumstances
- Rocard’s exchange principle
- The Daubert test
- None of the above
Rocard’s exchange principle
- What are the three main electronic communications eavesdropping laws?
The Electronic Communications Privacy Act;
the Wiretap Act;
the Pen Register and Trap and Trace Statute
- What is another common term for computer forensics?
Computer forensics also is known as system forensics, digital forensics, computer forensic analysis, computer examination, data recovery, and inforensics (information forensics) These are interchangeable
- Which type of computer forensics focuses on examining programming code?
- Media analysis
- Malware forensics
- Internet forensics
- Network analysis
- None of the above
Malware forensics
- Which forensic certification is only available to law enforcement personnel?
- CCE
- GCFA
- CCFE
- EnCE
- None of the above
None of the above
