Quiz 4 Flashcards
Securing a traditional scene is accomplished by (choose all that apply)
stringing crime tape.
posting guards.
asking people to leave.
Books and manuals can give investigators clues as to the skill level of the target but not what kind of technology they may be up against. True or False?
False
Cellphones are vulnerable because (choose all that apply)
they may be wiped by the cell provider.
the battery may drain.
The correct order of volatility (from most volatile to least volatile)
registers, memory, archival media.
Under certain legal requirements, your notes could become discoverable and made available to the opposing side. This can happen if you take your notes with you to the witness stand. True or False?
True
A bit for bit copy of a hard drive is known as a (choose all that apply)
forensic clone.
bit stream image.
Copying and pasting gets the active data - that is, data that are accessible to the user as well as deleted files. True or False?
False
Exigent circumstances may provide rationale for conducting your examination on the original digital evidence. True or False?
True
The suspect’s drive is known as the destination drive and the drive the investigator is cloning to is called the source drive because it is the source of the analysis. True or False?
False
“The process of identifying, preserving, collecting, preparing, reviewing, and producing ESI in the context of the legal process” is the definition of
discovery
What does FRE stand for?
Federal Rules of Evidence
What should you do while copying data on a suspect’s computer that is still live?
Make notes regarding everything you do.
To investigate employees suspected of improper use of company digital assets, a company policy statement about misuse of digital assets allows corporate investigators to conduct covert surveillance with little or no cause, and access company computer systems and digital devices without a warrant. True or False?
True
If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.
one
_______ does not recover data in free or slack space.
Sparse acquisition
Which system below can be used to quickly and accurately match fingerprints in a database?
Automated Fingerprint Identification System (AFIS)
_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.
Hearsay
As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?
The decision should be left to the Digital Evidence First Responder (DEFR).
Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?
United States v. Salgado
In cases that involve dangerous settings, what kind of team should be used to recover evidence from the scene?
HAZMAT
