Quiz 1 CCF10103

1.                Which of the following is not a component of “chain of evidence”?

• Time evidence obtained

• Location evidence obtained

• Who discovered the evidence

• Identification of person who left the evidence

From a legal perspective, which rule must be addressed when investigating a computer crime?

• A                Evidence

• Engagement

• A                Data protection

• A                Search and seizure

1.                Which of the following evidence collection method is most likely accepted in a court case?

• Create a file-level archive of all files

• Provide a full system backup inventory

• Provide a mirror image of the hard drive

• A                Copy all files accessed at the time of the incident

1.                Before powering off a computer system, what is the action should be taken by computer crime investigator in crime scene?

• A                backup the hard drive.

• collect the owner’s boot up disks.

• A                save the contents of the spooler queue.

• A                record contents of the monitor and dump the memory contents to a disk

1.                All of the following methods ensure the stored data are unreadable except;

• A                   degaussing the disk or tape.

• A                   physical alteration of media.

• writing random data over the old file

• A                   removing the volume header information.

If the Internet History file has been deleted, which of information may still provide about what Web sites the user has visited?

• A                Cookies

• Metadata

• A                Sessions

• A                User profiles

1.                Generally, the hidden messages appear to be (or be part of) something else: images, articles, shopping lists, or some other cover text. Thus, the ability to hide data in another file is called;

• Encryption

• Data parsing

• A                Steganography.

• A and B

1.                Chain of custody is subset of preservation process. How is the chain of custody maintained?

• A                By documenting what, when, where, how, and by whom evidence was seized

• A                By documenting in a log the circumstances under which evidence was removed from the evidence control room

• A                By documenting the circumstances under which evidence was subjected to analysis

• A                All of the above

1.                When a forensic copy is made, in what format are the contents of the hard drive stored?

• As compressed images

• A                As bootable files.

• A                As executable files.

• A                As operating system files

1.                Which of the following is the least important information to record when logging a security violation?

• A                User id.

• A                User’s name

• A                Type of violation

• A                Date and time of the violation