Digital evidence can be altered, damaged or destroyed with little effort.

At which stage of the digital forensics process would a write-blocker be used?

The process of copying data is known as:

Harold, a fraud examiner, collects a computer hard drive as potential evidence in an investigation. He creates a memorandum to record the chain of custody and documents what item was received, when it was received, and from whom it was received. To meet the minimum standard for a chain of custody memorandum, what else would Harold need to include?

_______ is the practice of concealing a file, message, image, or video within another file, message, image, or video.

Command to find out the internal ip using the dos prompt is ?

___is an example of social engineering techniques being used to deceive users. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators

Hash Value is used to check the

_________________

A ____value is a numeric value of a fixed length that uniquely identifies data.

The practice of forensic document examination is called graphology.

Which of the following is FALSE

____ is the route the evidence takes from the time you find it until the case is closed or goes to court.

A keyword search is part of the analysis process within what forensic function?

A. reporting

B. reconstruction

C. extraction

D. acquisition

Ron, a computer forensics expert, is investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in ON condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner. Which of the following key combinations can he use to recover the IMEI number?

For forensic Experts, it is important to understand the Internet’s protocols so that they:

1. This refers to the unauthorized monitoring of other people's communications, such as simply looking over the shoulder of a legitimate computer user to learn his login name and password.

A. Phishing

B. Spamming

C. Spoofing

D. Eavesdropping

Billy, a computer forensics expert, has recovered a large number of OST files during

forensic investigation of a laptop. Which of the following email clients he can use to analyze

the OST?

When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed exists only in the form of volatile data.

If a fraud examiner was gathering information about a fraud suspect, which of the following types of information would likely require access to nonpublic sources of information to obtain?