TEST BANK
Digital Archaeology: The Art and Science of Digital Forensics, | 1st edition
By Michael Graves
TU
TO
R
G
U
R
U
, Table of Content
Chapter 1: The Anatomy of a Digital Investigation
Chapter 2: Laws Affecting Forensic Investigations
Chapter 3: Search Warrants and Subpoenas
Chapter 4: Legislated Privacy Concerns
Chapter 5: The Admissibility of Evidence
Chapter 6: First Response and the Digital Investigator
Chapter 7: Data Acquisition
TU
Chapter 8: Finding Lost Files
Chapter 9: Document Analysis
Chapter 10: E-mail Forensics
TO
Chapter 11: Web Forensics
Chapter 12: Searching the Network
Chapter 13: Excavating a Cloud
R
Chapter 14: Mobile Device Forensics
G
Chapter 15: Fighting Ant forensics
Chapter 16: Litigation and Electronic Discovery
U
Chapter 17: Case Management and Report Writing
Chapter 18: Tools of the Digital Investigator
R
Chapter 19: Building a Forensic Workstation
U
Chapter 20: Licensing and Certification
Chapter 21: The Business of Digital Forensics
, All Chapters Included
jhgfdsa
From Digital
Chapter 1
Archaeology, by Review
All Answers Included
Michael Graves Questions
1. In Eoghan Casey’s model of an investigation there are multiple steps. Which of these is not one of those steps?
a. Examination
*b. Interrogation
c. Identification/Assessment
d. Preservation
e. Reporting
2. The process of documentation begins in the Identification/Assessment phase.
TU
*a. True
b. False
3. Which of the following would not likely be a stakeholder in a civil lawsuit against a major automobile manufacturer?
a. Government regulatory agencies
TO
b. The United Autoworkers Union
c. The judge assigned to the case
d. Owners of that company’s products
*e. All of these would be interested parties.
4. Collecting exculpatory evidence is exclusively the responsibility of the defense counsel.
a. True
R
*b. False
5. How many steps are there in Eoghan Casey’s Investigation Model?
G
Correct Answer(s):
a. 6
b. six
c. six.
d. 6.
U
6. Bob Smith is suspected of using his company’s Internet facilities as a conduit for sending large quantities of SPAM to
millions of users. You are called in to examine his computer to see if there is evidence to support this claim. This is initially
a form of what type of investigation?
R
a. Civil
*b. Internal
c. Criminal
U
d. This is not something you would do.
7. You suspect that there are a number of deleted files that can still be salvaged in the unallocated space of a drive
image. During which phase of the investigation would you use a data carving utility?
*a. Examination
b. Acquisition
c. Identification/Assessment
d. Analysis
e. Reporting
8. During which phase of an investigation do you make your first entries into a chain of custody log?
a. Examination
*b. Acquisition
c. Identification/Assessment
kjhgfdsa
, All Chapters Included
jhgfdsa
d. Analysis All Answers Included
e. Reporting
9. Criminal cases have more stringent evidence-gathering requirements because .
a. Only civil cases fall under constitutional guidelines.
b. Criminal cases are generally handled by Federal judges.
*c. The Constitution protects the rights of citizens being tried in criminal proceedings.
d. Civil cases do not involve jail time or possible capital punishment.
e. They don’t. Civil cases have the most stringent requirements.
10. A person has been sued by her neighbor for building a fence on the wrong side of the property line. She tries to act as
her own defense attorney and is battered in court. She can appeal the case on Constitutional grounds, since she was
never advised of her right to be represented by counsel.
???What does this one have to do with the book? Could this be reworded as a computer related case? -Michael
TU
a. True
*b. False
11. When qualifying an incident as a computer crime, which of the following characteristics would not be considered a
valid description?
a. The data in the computer are the objects of the act.
TO
b. The computer is the instrument or the tool of the act.
*c. The computer is one of the objects stolen during a burglary.
d. The computer is the target of an act.
12. What is the purpose of having a model for investigations? How does it help the investigator or the student learning to
be an investigator?
Correct Answer:
R
A model acts as a blueprint for how an investigation should be structured. It allows students to break an investigation
down into basic steps, making it easier to learn the process. It allows the seasoned professional to make sure that nothing
is missed in the course of the project.
G
13. Why is it necessary to calculate hash values on the primary image made from a suspect’s hard drive? How many
hash calculations do you make?
Correct Answer:
U
You calculate the hash value for the original volume and compare it to the value you get from the copy. They must match.
If not, you need to figure out why it doesn’t and document the reason. How many do you make? That’s kind of a trick
question. Ideally, you will make two calculations for each copy. If you have both MDA5 and a SHA-256 calculations for
each copy, and each version matches, it will be very difficult for the opposition to challenge the validity of your copies.
R
14. Collecting the legal authorizations to begin an investigation are part of the stage of the model.
*a. Identification/Assessment
b. Analysis
U
c. Collection/Acquisition
d. Reporting
15. You work for a private organization that contracts out forensic investigations. In the process of examining a suspect’s
hard drive in the course of an internal investigation, you come across numerous files that are quite obviously child
pornography. You turn them over to the local law enforcement, which obtains a warrant and seizes the computer. Which
document applies to this situation?
*a. FRCP
b. FRE
c. PMBOX
d. None. You were acting privately.
16. What is the first thing that you should do upon acquiring a new tool for your forensic department?
kjhgfdsa
Digital Archaeology: The Art and Science of Digital Forensics, | 1st edition
By Michael Graves
TU
TO
R
G
U
R
U
, Table of Content
Chapter 1: The Anatomy of a Digital Investigation
Chapter 2: Laws Affecting Forensic Investigations
Chapter 3: Search Warrants and Subpoenas
Chapter 4: Legislated Privacy Concerns
Chapter 5: The Admissibility of Evidence
Chapter 6: First Response and the Digital Investigator
Chapter 7: Data Acquisition
TU
Chapter 8: Finding Lost Files
Chapter 9: Document Analysis
Chapter 10: E-mail Forensics
TO
Chapter 11: Web Forensics
Chapter 12: Searching the Network
Chapter 13: Excavating a Cloud
R
Chapter 14: Mobile Device Forensics
G
Chapter 15: Fighting Ant forensics
Chapter 16: Litigation and Electronic Discovery
U
Chapter 17: Case Management and Report Writing
Chapter 18: Tools of the Digital Investigator
R
Chapter 19: Building a Forensic Workstation
U
Chapter 20: Licensing and Certification
Chapter 21: The Business of Digital Forensics
, All Chapters Included
jhgfdsa
From Digital
Chapter 1
Archaeology, by Review
All Answers Included
Michael Graves Questions
1. In Eoghan Casey’s model of an investigation there are multiple steps. Which of these is not one of those steps?
a. Examination
*b. Interrogation
c. Identification/Assessment
d. Preservation
e. Reporting
2. The process of documentation begins in the Identification/Assessment phase.
TU
*a. True
b. False
3. Which of the following would not likely be a stakeholder in a civil lawsuit against a major automobile manufacturer?
a. Government regulatory agencies
TO
b. The United Autoworkers Union
c. The judge assigned to the case
d. Owners of that company’s products
*e. All of these would be interested parties.
4. Collecting exculpatory evidence is exclusively the responsibility of the defense counsel.
a. True
R
*b. False
5. How many steps are there in Eoghan Casey’s Investigation Model?
G
Correct Answer(s):
a. 6
b. six
c. six.
d. 6.
U
6. Bob Smith is suspected of using his company’s Internet facilities as a conduit for sending large quantities of SPAM to
millions of users. You are called in to examine his computer to see if there is evidence to support this claim. This is initially
a form of what type of investigation?
R
a. Civil
*b. Internal
c. Criminal
U
d. This is not something you would do.
7. You suspect that there are a number of deleted files that can still be salvaged in the unallocated space of a drive
image. During which phase of the investigation would you use a data carving utility?
*a. Examination
b. Acquisition
c. Identification/Assessment
d. Analysis
e. Reporting
8. During which phase of an investigation do you make your first entries into a chain of custody log?
a. Examination
*b. Acquisition
c. Identification/Assessment
kjhgfdsa
, All Chapters Included
jhgfdsa
d. Analysis All Answers Included
e. Reporting
9. Criminal cases have more stringent evidence-gathering requirements because .
a. Only civil cases fall under constitutional guidelines.
b. Criminal cases are generally handled by Federal judges.
*c. The Constitution protects the rights of citizens being tried in criminal proceedings.
d. Civil cases do not involve jail time or possible capital punishment.
e. They don’t. Civil cases have the most stringent requirements.
10. A person has been sued by her neighbor for building a fence on the wrong side of the property line. She tries to act as
her own defense attorney and is battered in court. She can appeal the case on Constitutional grounds, since she was
never advised of her right to be represented by counsel.
???What does this one have to do with the book? Could this be reworded as a computer related case? -Michael
TU
a. True
*b. False
11. When qualifying an incident as a computer crime, which of the following characteristics would not be considered a
valid description?
a. The data in the computer are the objects of the act.
TO
b. The computer is the instrument or the tool of the act.
*c. The computer is one of the objects stolen during a burglary.
d. The computer is the target of an act.
12. What is the purpose of having a model for investigations? How does it help the investigator or the student learning to
be an investigator?
Correct Answer:
R
A model acts as a blueprint for how an investigation should be structured. It allows students to break an investigation
down into basic steps, making it easier to learn the process. It allows the seasoned professional to make sure that nothing
is missed in the course of the project.
G
13. Why is it necessary to calculate hash values on the primary image made from a suspect’s hard drive? How many
hash calculations do you make?
Correct Answer:
U
You calculate the hash value for the original volume and compare it to the value you get from the copy. They must match.
If not, you need to figure out why it doesn’t and document the reason. How many do you make? That’s kind of a trick
question. Ideally, you will make two calculations for each copy. If you have both MDA5 and a SHA-256 calculations for
each copy, and each version matches, it will be very difficult for the opposition to challenge the validity of your copies.
R
14. Collecting the legal authorizations to begin an investigation are part of the stage of the model.
*a. Identification/Assessment
b. Analysis
U
c. Collection/Acquisition
d. Reporting
15. You work for a private organization that contracts out forensic investigations. In the process of examining a suspect’s
hard drive in the course of an internal investigation, you come across numerous files that are quite obviously child
pornography. You turn them over to the local law enforcement, which obtains a warrant and seizes the computer. Which
document applies to this situation?
*a. FRCP
b. FRE
c. PMBOX
d. None. You were acting privately.
16. What is the first thing that you should do upon acquiring a new tool for your forensic department?
kjhgfdsa
