Digital Forensics Quiz 8

__increases the time & resources needed to extract,analyze & present evidence

• Investigation plan

• Litigation path

• Scope creep

• Court order for delivery

You begin any computer forensics case by creating a(n)__

• evidence custody form

• investigation plan

• investigation report

• risk assessment report

In civil &criminal cases,scope is defined by search warrants or__(specify what data to recover)

• risk assessment reports

• investigation plans

• subpoenas

• scope creeps

There are__searching options for keywords which FTK offers

• 1

• 2

• 3

• 4

__search can find items like text hidden in unallocated space that won't show in indexed search

• Live

• Online

• Inline

• Active

The__search feature allows you to look for words with extensions like "ing", "ed" etc.

• fuzzy

• stemming

• permutation

• similar-sounding

In FTK__search mode, you can find files that were accessed/changed during a certain time period

• live

• indexed

• inline

• active

FTK & other computer forensics programs use__to tag & document digital evidence

• indents

• tracers

• hyperlinks

• bookmarks

Getting a hash value with a__is much faster & easier than with a(n)__

• hexadecimal editor, computer forensics tool

• computer forensics tool, hexadecimal editor

• HTML editor, hexadecimal editor

• high-level language, assembler

AccessData__compares known file hash values to files on evidence drives to find suspicious data

• NSRL

• NTI

• KFF

• PKFT