What will allow the investigator to arrive at a scene, acquire the needed data, and return to the lab as quickly as possible? …
Sniffing data transmissions between a suspect’s computer and a network server.
When investigators arrive at a crime scene the first step should be to?
“The initial responding officer (s), upon arrival,
shall assess the scene and treat the incident as a crime scene
. They shall promptly, yet cautiously, approach and enter the crime scene, remaining observant of any persons, vehicles, events, potential evidence, and environmental conditions.”
When an investigator finds a mix of information judges often issue a limiting phrase to the warrant which allows the police present all evidence together?
| Question Answer | When an investigator finds a mix of information, judges often issue a(n) _________________________ to the warrant, which allows the police to separate innocent information from evidence. limiting phrase |
|---|
What technique can be used for extracting evidence from large systems?
| Question Answer | One technique for extracting evidence from large systems is called ______ ___________. sparse acquisition | The most common computer-related crime is _____ _____. check fraud | A ________ is a column of tracks on two or more disk platters. cylinder |
|---|
What type of records are considered data that the system maintains such as system log files and proxy server logs?
Computer-stored records
. are data the system maintains, such as system log files and proxy server logs. They are output generated from a computer process or algorithm, not usually data a person creates.
What are the 5 steps of processing a crime scene?
The basic crime scene procedures are
physical evidence recognition, documentation, proper collection, packaging, preser- vation, and, finally, scene reconstruction
.
What are the 7 basic steps in crime scene investigation?
- Secure the Scene.
- Separate the Witnesses.
- Scan the Scene.
- Photograph the Evidence.
- Sketch the Scene.
- Search the Scene.
- Secure and Collect Evidence.
When an investigator finds a mix of information judges often issue?
When an investigator finds a mix of information, judges often issue
a limiting phrase to the warrant
, which allows the police to present all evidence together.
What is the most common and flexible data acquisition method?
| Question Answer | The most common and flexible data-acquisition method is _____________ ____ ____. Disk-to-Image file copy | If your time is limited, consider using a logical acquisition or _____ acquisition data copy method. sparse |
|---|
What is most often the focus of digital investigations in the private sector?
User groups for a specific type of system can be very useful in a forensics investigation. Most digital investigations in the private sector involve
misuse of computing assets
.
Where should your computer backups be kept?
You should store backup copies of your files
somewhere separate from your computer — on an external hard disk
, for example. That way, if the computer breaks, or is lost or is stolen, the backup will still be intact. For maximum security, you shouldn’t keep the backup in the same building as your computer.
In which format are most digital photographs stored quizlet?
- File Compression. File compression can be achieved in basically two ways: lossless and lossy. …
- JPEG Define. JPEG (which stands for Joint Photographic Expert Group) is the most popular form of storing digital images. …
- JPEG + …
- JPEG – …
- TIFF Define. …
- TIFF + …
- TIFF – …
- TIFF: Type of configuration.
What should you do to handle evidence contained in large computer components?
What should you do to handle evidence contained in large computer components? To secure and catalog the evidence contained in large computer components, you can use
large evidence bags, tape, tags, labels, and other products available
from police supply vendors or office supply stores.
What program serves as the GUI front end for accessing sleuth kit’s tools?
Autopsy®
is an easy to use, GUI-based program that allows you to efficiently analyze hard drives and smart phones.
What does FRE stand for in digital forensics?
The
Federal Rules of Evidence
(FRE) are the guides for investigators and responders in the actual collection and use of evidence in court cases. The FRE is the code of evidence law governing the admission of facts by which parties in the US federal court system may prove their cases, both civil and criminal.
Can be any information stored or transmitted in digital form?
Digital evidence or electronic evidence
is any probative information stored or transmitted in digital form that a party to a court case may use at trial.
