CNIT 420 - EXAM 1 QUESTIONS WELL ANSWERED LATEST UPDATE 2026

CNIT 420 - EXAM 1 QUESTIONS WELL ANSWERED LATEST UPDATE 2026 Inculpatory - Answers "incriminating" or provides evidence of an action Exculpatory - Answers provides evidence of a lack of action Investigations Triad - Answers Vuln/Threat Assessment and Risk Management | Network Intrusion Detection and Incident Response | Digital Investigations case law - Answers When statutes don't exist, ______ is used Public Sector - Answers Gov agencies, subject to US Criminal and Constitutional Law Private Sector - Answers Corporate, policy violations and litigation disputes, can transform into a criminal investigation Blotter - Answers Historical database of previous crimes Digital Evidence First Responder - Answers Arrives on an incident scene, assesses the situation, and takes precautions to acquire and preserve evidence Digital Evidence Specialist - Answers Has the skill to analyze the data and determine when another specialist should be called in to assist Affidavit - Answers a sworn statement of support of facts about or evidence of a crime Line of authority - Answers states who has the legal right to initiate an investigation, who can take possession of evidence, and who can have access to evidence Acceptable Use Policy - Answers Most important policies define rules for using the company's computers and networks warning banner - Answers Business can avoid litigation by displaying a ____ on computer screens To minimize risk to the company - Answers What is a private-sector investigator's job? You search for evidence to support allegations of violations - Answers What happens during private investigations? Chain of custody - Answers Route the evidence takes from the time you find it until the case is closed or goes to court Write-blockers - Answers Enables you to boot to Windows w/o writing data to the evidence drive Tool shall block any manipulative commands to a protected drive, shall not block access commands, and shall give an indication to the user that the tool is active - Answers What are the big three mandatory requirements for write blockers? Bit-stream copy - Answers bit-by-bit copy of the original storage medium Bit-stream image - Answers File containing the bit-stream copy of all data on a disk or partition Preserve the original evidence...conduct the analysis on a copy of the data - Answers What is the first rule of computer forensics? T - Answers Deleted files linger on the disk until new data is saved on the same physical location (T/F) image file - Answers Data in a forensics acquisition tool is stored in what type of file? Raw, Proprietary, Advanced Forensics - Answers What are the three formats of an image file? Raw Format - Answers Writes bit-stream data to files, ignores minor data read errors, tools might not collect marginal (bad) sectors, requires as much storage as original disk or data Proprietary Format - Answers Can integrate metadata into the image file, Expert Witness Compression format is unofficial standard Advanced Forensics Format - Answers Provide (un/)compressed image files, Includes metadata, self-authentication Static acquisition - Answers Live acquisition - Answers Disk-to-image - Answers Data collection method: Most common method and offers most flexibility, copies are bit-for-bit replications of the original drive Disk-to-disk - Answers Data collection method: tools can adjust disk's geometry configuration Logical acquisition - Answers Data collection method: captures only specific files of interest to the case Sparse acquisition - Answers Data collection method: collects fragments of unallocated data Creating a copy - Answers Data collection method: Size of source disk (lossless compression), large drives 2 (use different tools or techniques) - Answers How many images of digital evidence should be made at minimum? BIOS level - Answers Copying a host protected area allows the investigator to access the drive at what level? Whole disk encryption - Answers BitLocker is a Windows feature that may require a decryption key. What is this called? fdisk - Answers What command lists, creates, deletes, and verifies partitions in Linux? - Answers What command formats a FAT file system from Linux? dd ("data dump") - Answers Creates raw format file that most computer forensics analysis tools can read FTK Imager Lite - Answers Makes disk-to-image copies of evidence drives, designed for viewing evidence disks CRC-32, MD5, and SHA1 to SHA-512 - Answers What are the validation techniques (hashing) F - Answers Raw format image files contain metadata (T/F) Redundant array of independent disks (RAID) - Answers Computer configuration involving two or more disks RAID 0 - Answers Rapid access and increased storage, lack of redundancy (striping) RAID 1 - Answers Designed for data recovery, files duplicated across disks (mirroring) RAID 2 - Answers Data written to disk on bit level, uses parity bit (striping) RAID 3 - Answers Striping and dedicated parity, requires at least 3 disks RAID 4 - Answers similar to RAID 3, data is written in blocks RAID 5 - Answers Parity recovery data on each disk, similar to RAID 0 and 3 RAID 6 - Answers Redundant parity on each disk RAID 10 - Answers Provides fast access and redundancy, (mirrored striping) RAID 15 - Answers Combo of RAID 1 and 5, costly ISO standard 27037 - Answers What standard gives guidance on what procedures countries should have in place for digital evidence? It can be changed more easily - Answers Why is digital evidence unlike other physical evidence? Computer-generated records and computer-stored records - Answers Computer records are usually categorized into: authentic and trustworthy - Answers Computer-generated and computer-stored records must be shown to be ____ and ____ to be admitted into evidence Fourth Amendment - Answers "describing the place to be searched, and the persons of things to be seized" Plain view doctrine - Answers "Objects falling in plain view of an officer who has the right to be in position to have that view are subject to seizure w/o a warrant and may be introduced into evidence" 1. Officer is where he or she has a legal right to be 2. Ordinary senses must not be enhanced by advanced technology in any way 3. Any discovery must be by chance (the incriminating character of the object must be immediately apparent) - Answers What are the three criteria that must be met for Plain View Doctrine T - Answers The plain view doctrine's applicability in the digital forensics world is being rejected (T/F) Forensically sound - Answers Term used to qualify and, in some cases, justify the use of a particular forensic technology or methodology Complementary Metal Oxide Semiconductor - Answers Where does the computer store system configuration and date and time info? Erase cycles - Answers Why does flash memory have a write endurance limit? wear-leveling - Answers All flash memory devices have a feature called ______ garbage collector - Answers Where are old memory cells listed in? logical addresses - Answers Cluster numbers assigned by the OS physical addresses - Answers Sector numbers disk partition - Answers Clusters and their addresses are specific to a logical disk drive partition - Answers A _____ is a logical drive partition gap - Answers Unused space between partitions 0x1BE - Answers What offset is the first partition at in a hex editor? A file is deleted - Answers å replaces the first letter of the filename representing what? resident and nonresident - Answers File or folder info is typically stored in what two ways in an MFT record? Alternate data streams - Answers Ways data can be appended to existing files w/o being seen