Filters
Question type

Study Flashcards

The first thing a crime scene investigator should do when encountering computer forensic evidence is:


A) tape each cable to its adjoining component in an effort to preserve the integrity of the physical connections.
B) procure a warrant to search.
C) document the scene.
D) remove the system to the laboratory for processing.
E) unplug every device from the CPU to preserve the hard disk drive.

F) A) and B)
G) A) and D)

Correct Answer

verifed

verified

A cluster is a group of ________ in multiples of ________.


A) cylinders, three
B) tracks, three
C) sectors, two
D) partitions, two
E) disks, four

F) B) and E)
G) B) and D)

Correct Answer

verifed

verified

One should not look for "latent" data in:


A) RAM slack.
B) temporary files.
C) unallocated space.
D) file slack.
E) deleted files.

F) None of the above
G) A) and B)

Correct Answer

verifed

verified

Describe how a hard disk is partitioned.

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

A hard disk is partitioned by dividing i...

View Answer

Which of the following actions taken at the crime scene involving a computer are incorrect?


A) upon arrival, sketching the overall layout as well as photographing it
B) photographing any running monitors
C) placing corresponding labels on cords from peripheral devices and the port to which each cord was connected
D) removing the plug from the back of the computer, not from the wall
E) none of the above

F) C) and E)
G) B) and C)

Correct Answer

verifed

verified

A motherboard:


A) has a socket to accept RAM.
B) connects to every device used by the system.
C) is the main circuit board within a computer.
D) all of the above
E) none of the above

F) A) and D)
G) B) and E)

Correct Answer

verifed

verified

What is the difference between and location of visible and latent data?

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

Visible data and latent data refer to tw...

View Answer

Describe the difference between read-only memory and random-access memory.

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

Read-only Memory (ROM) and Random-Access Memory (RAM) are two fundamental types of memory used in computers and electronic devices, each serving distinct purposes and having different characteristics. Read-only Memory (ROM): 1. Non-volatile: ROM retains its data even when the power is turned off. This makes it ideal for storing firmware or permanent software that should not be altered or lost when the device is powered down. 2. Pre-programmed: Data in ROM is typically written during the manufacturing process and is not intended to be modified by the end-user. Some types of ROM, like EEPROM, can be rewritten, but this is a slow process and not done frequently. 3. Read-only: As the name suggests, ROM is primarily designed to be read from, not written to. It is used to store the instructions for booting up the computer or device (the bootloader or BIOS). 4. Speed: ROM is generally slower than RAM in terms of data access speeds. Random-Access Memory (RAM): 1. Volatile: RAM requires power to maintain its data. When the device is turned off, the data stored in RAM is lost. This is why you lose unsaved work if your computer crashes or is turned off unexpectedly. 2. Read and Write: RAM is used by the CPU to read and write data quickly. It is where a computer temporarily stores data that is actively being used or processed, which allows for fast access and manipulation. 3. Dynamic: The contents of RAM change frequently as programs are opened and closed and as different tasks are performed. It is the workspace for the computer's processor. 4. Speed: RAM is much faster than ROM. This speed allows the CPU to access instructions and data quickly, which is essential for the smooth operation of programs. In summary, ROM is non-volatile and used for permanent storage of critical instructions that do not change, while RAM is volatile and used for temporary storage of data that is actively being used or processed by the CPU. ROM is about long-term stability and preservation, whereas RAM is about speed and flexibility for on-the-fly data manipulation.

Which of the following is NOT considered a type of software?


A) Linux
B) Unix
C) Firefox
D) Random Access Memory
E) Excel

F) A) and E)
G) All of the above

Correct Answer

verifed

verified

The definition of software is:


A) primary component of storage in the personal computer
B) program permitting the user to manage files and applications
C) set of instructions compiled into a program that performs a particular task
D) storage programs used to start the boot process
E) a complex network of wires that carry data from one hardware device to another

F) B) and D)
G) A) and D)

Correct Answer

verifed

verified

C

One of the most common places to begin to look for evidential data is in:


A) any learn-to-type tutorial.
B) the spreadsheet files.
C) the word processing or text-based document files.
D) a CAD package.
E) a photograph editing program.

F) A) and D)
G) A) and C)

Correct Answer

verifed

verified

Evidentiary data may be recovered from which of the following?


A) RAM swap files
B) unallocated space on the HDD
C) slack space on the HDD
D) all of the above
E) none of the above

F) B) and E)
G) B) and C)

Correct Answer

verifed

verified

D

One should not search for "visible" data in:


A) unallocated space.
B) swab files.
C) windows.
D) Quicken.
E) temporary files.

F) None of the above
G) A) and B)

Correct Answer

verifed

verified

Explain the various areas found on the computer where a user's Internet activities can be investigated.

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

There are several areas on a computer wh...

View Answer

What are the areas of the computer that forensic examiners will examine to retrieve forensic data.

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

Computer forensic examiners investigate ...

View Answer

List and describe the hardware and the software components of a computer.

Correct Answer

Answered by ExamLex AI

Answered by ExamLex AI

Sure! The hardware components of a compu...

View Answer

What keeps track of the location of files and folders on the HDD?


A) the HDD itself
B) the CD-ROM
C) the FAT
D) the CPU
E) the search engine

F) C) and E)
G) D) and E)

Correct Answer

verifed

verified

The complex of wires located on the motherboard which serves to carry data from one hardware device to another is:


A) the BIOS.
B) system bus.
C) RAM.
D) ROM.
E) central processing unit.

F) A) and B)
G) A) and C)

Correct Answer

verifed

verified

A device that permits only requested traffic to enter a computer system is known as a(n) :


A) internet cache
B) network traffic manager
C) firewall
D) central processing unit (CPU)
E) cookie

F) C) and E)
G) A) and D)

Correct Answer

verifed

verified

Which of the following is/are potential sources for forensic evidence on a suspect's personal computer?


A) Internet "cookies"
B) Internet history
C) cache
D) all of the above
E) A and B only

F) C) and E)
G) C) and D)

Correct Answer

verifed

verified

Showing 1 - 20 of 47

Related Exams

Show Answer