IS4670 CHAPTER 4 Forensics Methods and Labs

Question 1

1. To be ________, data must be complete and materially unaltered.

Answer 1

Forensically sound

Question 2

2. Which of the following governs whether, when, how, and why proof of a legal case can be placed before a judge or jury?
A. Forensic soundness 
B. Computer-generated evidence 
C. Rules of evidence 
D. Human-generated evidence

Answer 2

Rules of evidence

Question 3

3. A framework for digital investigation to ensure forensic soundness must have six phases.
   A. True
   B. False

Answer 3

False

Question 4

4. A ________ can help justify the acquisition of newer and better resources to investigate computer forensics cases.

Answer 4

Business case

Question 5

5. Which of the following provides guidelines for managing a forensics lab and acquiring crime and forensics lab certification?
A. NIST 
B. ASCLD 
C. FRE 
D. DFRWS

Answer 5

ASCLD

Question 6

6. Only very large computer forensics labs need a lab manager.
   A. True
   B. False

Answer 6

FALSE

Question 7

7. Which of the following costs should a computer forensics lab budget include? (Select three.)
A. Facility costs 
B. Hardware costs 
C. Software costs 
D. Law enforcement costs 
E. Cleaning costs

Answer 7

Facility costs

Hardware costs

Software costs

Question 8

8. Staff members in a computer forensics lab should have sufficient training to perform their tasks. Necessary skill sets include all except which of the following?
A. Hardware knowledge 
B. Software knowledge 
C. Background as an attorney 
D. Deductive reasoning

Answer 8

Background as an attorney

Question 9

9. A forensic workstation should be set up in a secure room in a forensics lab. What are some important features for such a room? (Select three.)
A. Large room 
B. Floor-to-ceiling walls 
C. Locking doors 
D. Fireproof doors 
E. Secure containers that lock

Answer 9

Floor-to-ceiling walls

Locking doors

Secure containers that lock

Question 10

10. Every organization should strive to make its lab a TEMPEST-qualified lab facility.
    A. True
    B. False

Answer 10

True

Question 11

11. Evidence storage containers should store only current evidence. Evidence for closed cases should be moved to a secure offsite facility.
    A. True
    B. False

Answer 11

True

Question 12

12. Which of the following logs should a computer forensics lab keep? (Select two.)
A. Computer use log 
B. Lab visitors’ log 
C. Evidence container log 
D. Criminal log

Answer 12

Evidence container log

Visitors log

Question 13

13. A forensics lab work area requires approximately ________ square feet.

Answer 13

150

Question 14

14. Which of the following does a forensics lab not need to stock?
A. Workstations 
B. Operating systems 
C. Legal manuals 
D. Hard drives

Answer 14

Legal manuals

Question 15

15. As a general precaution, it is a good idea to back up a workstation once a month.
    A. True
    B. False

Answer 15

False