What is BERLA used to collect data from?

Sometimes the process of using BERLA is destructive.

What does BFU stand for?

Using end-to-end keys that are required to open the contents of digital information is a process called ______.

If a computer is off, you should leave it off when collecting it.

Why is it necessary to remove a device from it's network when collecting it?

It is OK to let an unlocked phone lock after you collect it.

Digital evidence examination involves looking for both ______ and ______ data on devices

When data is _____, that data is overwritten with 0s and is gone.

When data is _______ on a device, it is not necessarily unrecoverable.

A bit-by-bit copy of a device is known as a _________ .

If two files have the same hash value, that indicates that they are exact copies of each other.

The SHA-512 and MD5 values above are examples of _________ .

What are the two types of compression?

What type of video frame shows the ENTIRE image, with nothing missing?

.avi is an example of this type of file that encapsulates media into one file.

________ is defined as the amount of detail in an image.

What are the main ways to extract video from a DVR?

Because all of this evidence is digital, we do not need to take photos of it or while we collect it.

DVR stands for ________ .

Which are phases of digital evidence history?

Digital examinations are completed on evidentiary devices themselves - as in, it's completed on the original device directly.

Digital examinations are completed on master copies of evidence.

Digital examinations are completed on working copies of evidence.

Your search warrant indicates that you can look for optical media. Which of the following are you allowed to collect?

Any device or media with electronic information storage may be relevant to the case and relied on in court proceedings is considered ___________ .

What are the steps of a digital investigation?

When the device itself contains the stolen data, it is considered the ______ .

What kind of crime are skimmers used in?

It is not important to gather and worry about traditional evidence (like fingerprints or DNA) when collecting/analyzing digital evidence.

Where are appropriate places to search for digital evidence at a crime scene? Select all that apply.

When you need to acquire an image and examine the entire contents of a device, you

would pick which image type?

Which one of these is NOT a challenge/privacy concern for IoT?

In 2016 the _______ attack on vulnerable IoT devices demonstrated the importance of creating strong passwords and completing regular firmware updates.

When collecting IoT devices, it is important to turn off network connections to prevent remote data manipulation or deletion?

Which of the following is NOT an example of IoT data being used in an investigation?

What is a forensic image?

Forensic Toolkit (FTK) is another tool used for ______ of forensic images.

Autopsy is another tool used for ______ of forensic images.

What is the most common forensic image file type?

When collecting a forensic image using FTK, the examiner can elect to encrypt the image.

In the case of Arkansas vs. Bates what kind of IoT device was used as crucial evidence in a murder investigation?

FTK, Autopsy, and most general forensic tools all do the same basic thing - collect and categorize information recovered from digital evidence.

Autopsy allows tagging of content.

The temperature where you store digital evidence doesn't matter.

This type of extraction only recovers visible data, not deleted data.

How you collect a computer will vary depending on it's state - on vs off, encryption programs present, etc.

If you collect a cell phone that is on but locked, what should you do? Select all that apply.

If you have to unplug a computer, you should unplug it from:

People never reuse passwords, so you don't need to collect anything from the scene with a password written on it.

When collecting video from a DVR, what filetype(s) should you always collect, if able?

______ storage is an internal media used by a computer to store data, usually referred to as the hard drive.

After digital evidence of a crime has been erased, a DE examiner can recover it.

Which one of these are reasons to collect both the native file type and common container file of a video file? Select all that apply.

When RAM memory is gone, its unretrievable.

Investigators can legally force someone to provide their password.

A device "dump" is also known as? Select all that apply.

On an encrypted device, like your phone, we must have the password or decryption key to get all of the information off of the device.

What type of extraction involves  physically removing flash memory chips from a subject device and then acquiring the raw data using specialized equipment?

Before conducting any search, an investigator needs proper search authority.

After serving a search warrant, you are required to list what you seized in the warrant.

____ data is things that the user can see and interact with on their device.

What it the process an examiner goes through to determine which items and in what order they will analyze from a case?