IS4670 Chapter 6 Controlling a Forensic Investigation

Question 1

1. What type of data is lost whenever a system is used and should therefore be collected first to minimize corruption or loss?
A. Bit stream data 
B. Forensic data 
C. Temporary data 
D. Volatile data

Answer 1

Volatile data

Question 2

2. The ________, as its name suggests, recommends leaving a suspect computer turned on and working on it immediately after securing it.

Answer 2

Live analysis school of thought

Question 3

3. Why is it important to create a bit stream copy of a disk drive or another type of storage media?
   A. A bit stream copy can be created very quickly.
   B. A bit stream copy exactly replicates all sectors on the storage device, including all files and ambient data storage areas.
   C. The Department of Defense requires bit
   stream copies in all investigations.
   D. It’s not. Standard file backups and network server backups are sufficient in most cases.

Answer 3

A bit stream copy exactly replicates all sectors on the storage device, including all files and ambient data storage areas.

Question 4

4. You should always work on the suspect hard drive rather than a backup, a duplicate, a copy, or an image.
   A. True
   B. False

Answer 4

FALSE

Question 5

5. In a forensic investigation, speed is more important than thoroughness.
   A. True
   B. False

Answer 5

FALSE

Question 6

6. Which of the following is a batch file that handles drivers for all the devices hooked up to the controllers and ports?
A. AUTOEXEC.BAT 
B. COMMAND.COM 
C. CONFIG.SYS 
D. DRVSPACE.BI

Answer 6

AUTOEXEC.BAT

Question 7

7. Which techniques of forensic analysis are discussed in this chapter? (Select three.)
A. Live analysis 
B. Volatile analysis 
C. Physical analysis 
D. Logical analysis

Answer 7

Live analysis

Physical analysis

Logical analysis

Question 8

8. Which of the following does Windows use on a system as a “scratch pad” to write data when additional RAM is needed?
A. Batch file 
B. Swap file 
C. File residue 
D. Unallocated space

Answer 8

Swap file

Question 9

9. Which of the following is the smallest unit of storage on a computer?
A. File allocation table (FAT) 
B. Cluster 
C. Sector 
D. File

Answer 9

Sector

Question 10

10. ________ is the area of a hard drive that has never been allocated for file storage, or the leftover area that the computer regards as unallocated after file deletion.

Answer 10

Unallocated space

Question 11

11. One of the first questions that can be asked in computer seizure law is when exactly the search occurs. The ________ Amendment to the U.S. Constitution deals with search and seizure.

Answer 11

Fourth

Question 12

12. Which of the following is not a best practice in preserving data for future computer forensics examination?
    A. Immediately turn on and attempt to examine the suspect computer.
    B. Identify all devices that may contain evidence.
    C. Quarantine all in-house computers.
    D. Forensically image all suspect media.

Answer 12

Immediately turn on and attempt to examine the suspect computer.