Computer Forensics Investigation Process

The process of copying data is known as:

• data acquisition

• data analysis

• data documentation

• data recovery

There are 2 types of data acquisition: static and __________.

Warrants are NOT needed during the search and seizure stage if:

• we are very sure the suspect is guilty.

• destruction of evidence is imminent.

• person with authority consents.

• the crime committed is in plain sight.

True or false: live acquisition can file metadata, like date and time values.

• True

• False

True or False: static acquisition will produce the same results no matter how many times the data is acquired.

• True

• False

The __________ format is an older, open source disk-to-image file format.

What are the advantages of the raw format?

• Fast data transfer

• Capability to ignore minor data read errors on the source drive.

• Does not require as much storage space as the original disk.

• Most forensic tools can read the raw format.

Common hash functions used for validation checks of forensic images are:

• MD5

• SHA-1 or higher

• CRC32

• DES3

In the _________________ stage, documentation/reporting and testifying as an expert witness are the key main tasks.

In the investigation phase, there are _____ sub-stages that take place.

• 4

• 5

• 6

• 7