Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

FSC360 > The Digital Evidence Investigation > Flashcards

The Digital Evidence Investigation Flashcards

1
Q

What is this a definition of:
the methodological acquisition, authentication, reconstruction, and examination of digital media using computer software, hardware, and analytical techniques for the purpose of presenting digital evidence in a judicial or quasi-judicial proceeding.

A

Digital forensics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What changes were made to the criminal code in 1983?

A

To address the use of computer to commit or aid in committing crimes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What type of testimony can police officers be called for in digital forensic investigations?

A

Expert or lay witness. Depends if opinion is needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What key terms related to digital forensics are defined in the criminal code?

A

Computer data
Transmission data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a preservation demand?

A

Requires a person to preserve computer data in their possession or control when the demand is made.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the conditions for making a preservation demand?

A

Officer must have reasonable grounds that:
An offence has been or will be committed; AND
The computer data is in the person’s possession or control and will assist in the investigation of the offence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the limitation of preservation demands?

A

The demand cannot be made to a person under a criminal investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the result of the limitation to preservation demands?

A

PD, production orders and assistance orders often go hand in hand and apply to non-accused persons who may have valuable evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What term does this define:
means representations, including signs, signals or symbols, that are in a form suitable for processing in a computer system

A

Computer data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What term is this defining:
means representations, including signs, signals or symbols, that are capable of being understood by an individual or processed by a computer system or other device. 

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What term is this defining:
a medium on which data is registered or marked

A

Document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What term is this defining:
data that relates to the location of a transaction, individual or thing. 

A

Tracking data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is transmission data?

A

Can see what a device is sending or communicating with, does not tell use the substance of that communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What information can be adduced from transmission data?

A

Date and time of communication
Duration of communication
General location of device based on cell tower data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a production order?

A

Order for company to produce the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an assistance order?

A

Requires company to assist in investigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Instead of digital or physical evidence, what term dose the Canada evidence act use?

A

Electronic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the best evidence rule with respect to digital evidence?

A

The party submitting the evidence should submit the original unless unable to do so.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

When is the best evidence rule satisfied?

A
  1. Proof of integrity of system; OR
  2. If evidentiary presumption applies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the two relevant assumptions related to digital evidence?

A

Presumption of integrity
Presumptions regarding secure electronic signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What type of evidence is digital evidence considered to be?

A

Latent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Does an electronic document in the form of a printout satisfy the best evidence rule?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the digital question to answer?

A

Who is responsible for performing some digital action on the subject media and what is the resulting output?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a byte?

A

Smallest collection of digits that will display on-screen in human readable format
8 digits displayed as a single character or digit

25
Q

What is the primary challenge for police early in a digital investigation?

A

Proper preservation of evidence. Must be identified before it is preserved

25
Q

What are the two components of the science of digital evidence?

A

Preservation
Analysis

26
Q

What are the 5 situations that identification of digital evidence typically applies to?

A

Seizures with judicial authorization
Street checks
Random Canada Border Service Agency checks
Prisoner processing
Voluntary productions of evidence

27
Q

What evidence related to digital evidence is processed first?

A

Most volatile evidence - DNA, fingerprints

28
Q

What are examples of judicial authorizations that can result from an ITO (information to obtain)?

A

Production orders
Search warrants
Tracking warrants
Transmission data recorder warrants
Part VI authorizations (wiretaps)

29
Q

What is a tracking warrant?

A

Provides information on location

30
Q

What us a transmission data recorder warrant?

A

Captions transmission data in real time.

31
Q

Who is able to authorize a wire tap?

A

Superior court justice

32
Q

What are the two types of criminal offences involving computers?

A

Technology-as-instrument
Technology-as-target

33
Q

What is technology-as-instrument?

A

Technology is instrumental in the commission of a crime.

34
Q

What is technology-as-target cybercrime?

A

Criminal offences targeting computers

35
Q

Outline the 9 steps of a digital investigation.

A

Identify potential sources of evidence
Preserve evidence
Collect info
Analyze
Investigators establish reasonable grounds based on analysis
Charges laid
Major crime management
Disclosure
Trial, etc.

36
Q

What are the two sources of data on a storage device?

A

Program or application
Output generated by that application

37
Q

What is the most common form of digital evidence?

A

Output

38
Q

What are the three types of data output?

A

User-created content
Application-generated content
System-generated content

39
Q

Give example of non-volatile storage devices.

A

Laptop hard drives
USB drives
SD cards
DVDs

40
Q

What are volatile storage devices? Give an example/

A

Lost when the computer is turned off.
RAM

41
Q

What important information can be extracted from volatile memory?

A

Passwords
Documents
Pictures
List of running processes

42
Q

What is an issue with mobile devices?

A

Susceptible to remote access, including phone locking and data destruction

43
Q

What are the two basic data types requiring preservation?

A

Public and private

44
Q

What are 4 types of private information that can be obtained from a service provider?

A

IP address
Name, address, phone number connected to owner
Cached content
Information stored in private view.

45
Q

What are the three methods of obtaining the forensic copy?

A
  1. Removal/connection of the subject media to a trusted system
  2. Booting the subject computer with a trusted boot disk
  3. Obtaining the data while the subject computer is running
46
Q

What is the traditional method of obtaining the forensic copy?

A

Removal/connection of the subject media to a trusted system

47
Q

When is the method of booting with a trusted boot disk used?

A

If source media cannot be removed.

48
Q

When is is most helpful to obtain the data when the subject computer is running?

A

When computer is connected to a network.

49
Q

What does forensic duplication software do?

A

Provides a method of validating the forensic copy against the source data

50
Q

What are the objectives of the analysis portion of a digital investigation?

A

Establish control over data
Establish ownership of the data
Determine how the data was produced and distributed

51
Q

What is the complicating factor during the analysis of digital evidence? What is its effect?

A

Encryption
Prevents unauthorized access

52
Q

How can link charts be used in communication data analysis?

A

Can show where people were when they spoke to others.

53
Q

How can call pattern analysis be used in a digital investigation?

A

Can reveal patterns relevant to crime and involvement of parties

54
Q

How can timelines be useful in digital investigations?

A

Helpful for understanding large scale cases

55
Q

How can flow charts be used in digital investigatons?

A

Show sequence of events

56
Q

How can maps be used in digital investigations?

A

Can visualize who was talking to who when, where and in what format

57
Q
A

FSC360 (25 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions