If you fail to handle evidence properly __________.

You may use Linux to make a __________ of the hard drive.

Use the Linux __________ command-line command to wipe the target drive in a forensics examination.

Use the Linux __________ command-line command to back up your hard drive if you want to create a hash.

Documentation of every person who had access to evidence, how they interacted with it, and where it was stored is called the __________.

Usually, the first thing you do to a computer to prevent further tampering is to __________.

__________ can include logs, portable storage devices, emails, tablets, and cell phones.

Windows stores information on web addresses, search queries, and recently opened files in a file called__________.

In Windows, the log that stores events from a single application or component rather than events that might have a systemwide impact is the __________ log.

In Windows, the log that contains events collected from remote computers is the __________ log.

The Linux log file that contains activity related to the web server is __________.

The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is __________.

__________ is a free tool that can be used to recover Windows files.

Which cell phone state identified by the U.S. National Institute of Standards is a dormant mode that conserves battery life while maintaining user data and performing other background functions?