IS4670 CHAPTER 3 TERMS & DEFINITIONS

Question 1

Attempts to adversely affect the existence, amount, and quality of evidence from a crime scene or to make the analysis and examination of evidence difficult or impossible to conduct.

Answer 1

Anti-forensics -

Question 2

Continuity of evidence that makes it possible to account for all that has happened to evidence between its original collection and its appearance in court, preferably unaltered.

Answer 2

Chain of custody -

Question 3

Raw numbers, pictures, and other “stuff ” that may or may not have relevance to a particular event or incident under investigation.

Answer 3

Data -

Question 4

A plan that lists the types of data to be collected and describes the expected sources for the data. It should also list any anticipated problems as well as recommended strategies to deal with those problems.

Answer 4

Data analysis plan -

Question 5

Information such as a chart that helps explain other evidence to a judge and jury.

Answer 5

Demonstrative evidence -

Question 6

Written evidence that must be authenticated, such as a printed report or a log file.

Answer 6

Documentary evidence -

Question 7

Anything that changes or destroys digital evidence between the time the evidence is created and when the case goes to court. An action that changes the evidence could be either accidental or deliberate.

Answer 7

Evidence Dynamics -

Question 8

Data that has been processed and assembled so that it is relevant to an investigation.

Answer 8

Information -

Question 9

A basic concept of forensic science, which states that “with contact between two items, there will be an exchange.” In other words, every contact leaves a trace.

Answer 9

Locard’s exchange principle -

Question 10

Data that is difficult to collect and analyze because it is encrypted, compressed, or in a proprietary format.

Answer 10

Obscured data -

Question 11

A physical object that can be touched, held, or directly observed, such as a hard drive or removable media. Also: Any evidence that speaks for itself, without relying on anything else. An example is a log produced by an audit function.

Answer 11

Real evidence -

Question 12

A court order that allows law enforcement personnel to collect equipment or data from that equipment. Search warrants are typically used by law enforcement officers.

Answer 12

Search warrant -

Question 13

A court order than requires the person or organization that owns the equipment to release it for analysis. These are typically used in civil actions or court proceedings.

Answer 13

Subpoena -

Question 14

Information that is used to support or interpret real or documentary evidence.

Answer 14

Testimonial evidence –

Question 15

Permission from a computer or equipment owner to search and/or seize equipment as part of an investigation

Answer 15

Voluntary surrender-