WorksheetsComputer Crime, Information Security & Digital Forensics
Total questions: 17
Worksheet time: 9mins
Which of the statements best describes Digital Forensics?
Applying computer scientific tests or techniques to help solve a crime
Is a legal order issued by the Courts that allows officers to arrest someone
When someone enters a building with the intent to steal something or commit a crime
Analysing and examining clothes, blood, hair, footprints or marks left by tools or weapons.
____________ is a data and image preview tool that allows you to browse files and folders on local hard drives, network drives, CD / DVD and review the content of forensic images or memory dumps.
FTK Imager
Volatility
HashCalc
An investigation can only be carried out when ....
there is a suspicion that a crime has been committed.
a person has a criminal history
a witness to an incident owns a mobile device
when working within a 'high security' company
Which three of the following are benefits of forensic readiness?
Forensic readiness reduces the costs of a digital forensic investigation.
Forensic readiness makes it easier for organisations to gather evidence.
Forensic readiness ensures that as much evidence as possible is available.
Forensic readiness makes it harder for a malicious hacker to access a network
Refers to any technique, device or software designed to hinder a computer investigation.
Anti-forensic computing.
Encryption.
File headers.
Where possible, the original contents of a device are copied and preserved, leaving the original data untouched.
The tool that does this is called...
Write Blocker
Copy Machine
Universal Serial Bus
WinZip
At which stage of the digital forensics process would a write-blocker be used?
Acquisition
Reporting
Verification
Analysis
Digital evidence can't be time sensitive.
TRUE
FALSE
Digital evidence can be altered, damaged or destroyed with little effort.
TRUE
FALSE
The process of copying data is known as:
data acquisition
data analysis
data documentation
data recovery
Hash Value is used to check the
_________________
Confidentiality of the file
Integrity of the file
rationality of the file
availability of the file
Which of the following is FALSE
The digital forensic investigator must maintain absolute objectivity
It is the investigator’s job to determine someone’s guilt or innocence.
It is the investigator’s responsibility to accurately report the relevant facts of a case.
The investigator must maintain strict confidentiality, discussing the results of an investigation on only a “need to know” basis
____ is the route the evidence takes from the time you find it until the case is closed or goes to court.
Hashing
Chain of Custody
Imaging
Data Recovery.
A keyword search is part of the analysis process within what forensic function?
Reporting
Reconstruction
Extraction
Acquisition
When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed exists only in the form of volatile data.
True
False
A verifiable procedure for sanitizing a defined area of digital media by overwriting each byte with a known value
Forensic Wipe
File Format
Extraction
You are save from attacker when your device contains no valuable information.
True
False
