CHFI Module 1

When is computer forensics typically utilized in the case of Noah's recent cyber incident?

• To optimize algorithms in software engineering for enhanced computational efficiency
  

• To investigate, recover, and analyze digital evidence in cases of cybercrime, fraud, or unauthorized data breaches
  

• To enhance the security protocols of an IT infrastructure by identifying vulnerabilities
  

• To develop machine learning models that predict user behavior on digital platforms

In what scenario would a company most likely employ computer forensics?

• During routine software updates to improve functionality
  

• After a data breach at Avery's company to determine the extent of the damage
  

• When launching a new product to analyze market trends
  

• To train employees on cybersecurity best practices

Before Jackson is called to testify as an expert, what must an attorney do first?

• engage in damage control

• prove that the tools you used to conduct your examination are perfect

•  read your curriculum vitae to the jury

• qualify you as an expert witness

What is the role of an expert witness in a legal case involving Benjamin's accident?

• To provide personal opinions on the case

• To present factual evidence based on their expertise

• To act as a legal advisor to the attorney

• To influence the jury's decision directly

During a class project, Harper needs to choose a tool for analyzing digital evidence. Which of the following is a common tool used in computer forensics?

• Word processing software

• Data recovery software

• Graphic design software

• Web development tools

What is a key challenge faced by computer forensic investigators like Kai and Harper?

• Finding enough storage space for data

• Ensuring the integrity of digital evidence

• Training staff on software usage

• Developing new software tools

Which of the following is true regarding digital evidence in a case involving Michael?

• the investigator does not need a search warrant if they deem the investigation necessary

•  investigators should not worry about the integrity of evidence

•  a duplicate copy should be made for analysis

•  investigators should only use the original for the investigation

Steve thought it would be funny to make some changes on Tom‘s computer at their office. Steve went into the Microsoft Windows registry and changed the keyboard mapping configuration on Tom‘s computer. Now Tom is unable to log into his computer because of the changes. Could Steve‘s actions warrant a cybercrime investigation?

•  Yes, because Steve performed a denial-of-service attack on Tom‘s computer

   

•  Yes, because modifying computer software is always treated as a federal offense

•  No, because there is no company policy that prohibits computer pranks on co-workers

• No, because this scenario describes a corporate investigation

You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?

• To control the room temperature

• To avoid electromagnetic emanations

• To make the lab soundproof

•  To strengthen the walls, ceiling, and floor

Fred, a cybercrime investigator for the FBI, finished storing a solid-state drive in a static resistant bag and filled out the chain of custody form. Two days later, John grabbed the solid-state drive and created a clone of it (with write blockers enabled) in order to investigate the drive. He did not document the chain of custody though. When John was finished, he put the solid-state drive back in the static resistant and placed it back in the evidence locker. A day later, the court trial began and upon presenting the evidence and the supporting documents, the chief justice outright rejected them. Which of the following statements strongly support the reason for rejecting the evidence?

• John investigated the clone instead of the original evidence itself

• John did not document the chain of custody

• Write blockers were used while cloning the evidence

• Block clones cannot be created with solid-state drives