ACCT 432 Ch. 13 Electronic Data

What is residual data?

• Slack space.
• Text files.
• Volatile data.
• Logs.

The Securities and Exchange Commission recommended the internal control framework used by which of the following organizations?

• SEC
• COSO
• AICPA
• COBIT

IT guidelines under the COSO framework include all of the following ^except:

• Objective setting.
• Internal auditing.
• Risk assessment.
• Risk response.

Which of the following SASs require auditors to display an increased attitude of skepticism?

• 99
• 80
• 54
• 64

An example of imaging software is:

• IDEA
• ACL
• SafeBack
• SAS

Forensic digital investigative skills include all of the following except:

• Hashing.
• Imaging.
• Scanning.
• Reading time stamps.

The “chain of custody” is a term that means:

• Electronic evidence has been imaged.
• Electronic evidence has been locked safely away.
• Electronic evidence has been preserved.
• A record of who has handled electronic evidence is maintained.

To investigate vast amounts of financial information in a business’s accounts, the auditor is most likely to use:

• Encase
• IDEA
• Disk Doctor
• SafeBack

One difference between data mining and computer forensic investigations is that data mining:

• Does not image the data.
• Assumes the files in a database have not been altered to hide information.
• Does not have files.
• None of the above.

In order to efficiently review accounting transaction logs, it is necessary to use:

• Regression analysis.
• A parser.
• Zipf’s Law.
• Disk investigator.