CNIT 420 EVALUATION EXAM 2026/2027 QUESTIONS
AND SOLUTIONS RATED A+
✔✔Collecting evidence according to the approved ___ of evidence control helps ensure
that the computer evidence is ____ - ✔✔- steps
- authentic
✔✔The FRE contains exceptions to providing ___ evidence - ✔✔Hearsay
✔✔The existence of these electronic files can't be disputed; however, their contents
require ____ testimony or ____ evidence - ✔✔- eyewitness testimony
- corroborating evidence
✔✔FRE Article VIII, Rule ___ cite EXCEPTIONS for when hearsay can be used -
✔✔Rule 802
✔✔Courts have consistently ruled that forensics investigators DON'T have to be subject
matter EXPERTS on what? - ✔✔The tools they use
✔✔US v. Salgado - ✔✔"It is NOT NECESSARY that the computer programmer testify in
order to authenticate computer-generated records."
✔✔The witness must have ___ - ___ knowledge only of facts RELEVANT to the case -
✔✔First-hand knowledge
✔✔If you have to TESTIFY about your role in acquiring, preserving, and analyzing
evidence, you DO NOT have to know the inner workings of the ____ you use, but you
SHOULD understand their ___ and ___ - ✔✔- Tools
- purpose and operation
✔✔You can safely testify that you DON'T KNOW ___ MD5 hashing alg works, but you
CAN ___ the steps for using the MD5 function in a specific tool - ✔✔- HOW
- describe
✔✔When attorneys challenge digital evidence, what is one test to prove that computer-
STORED records are authentic? - ✔✔Demonstrate that a specific PERSON created the
records
✔✔The author of a Microsoft Word doc can be identified using what? - ✔✔File metadata
✔✔Case that showed importance of file metadata: - ✔✔BTK Strangler
✔✔Software used to identify the metadata of a file: - ✔✔OSForensics Software
, ✔✔Is establishing who created digital evidence easy or hard? - ✔✔Hard
✔✔Records recovered from ___ space or ___ disk space usually DON'T IDENTIFY the
___. This also goes for ___ emails or text messages. - ✔✔- Slack space
- Unallocated disk space
- Author
- Anonymous
✔✔Unallocated Space - ✔✔Portions of a disk partition that DO NOT contain active data.
✔✔When a file on a hard drive containing data is ___, the data belonging to the file
REMAINS on the disk - ✔✔Deleted
✔✔The data part of a file remaining on a disk after a file is deleted? - ✔✔Unallocated
Space
✔✔Unallocated space is also called? - ✔✔Unallocated Clusters
✔✔How long does the data from a deleted file remain on the disk? - ✔✔Until it's
OVERWRITTEN by another file
✔✔Slack Space - ✔✔Space on a disk between the end-of-file marker and the end of the
cluster
✔✔Is it common or rare for file sizes to exactly match the size of 1 or multiple clusters
perfectly? - ✔✔Rare
✔✔Unused space on a disk - ✔✔Slack Space / Cluster
✔✔To establish authorship of digital evidence in these cases, attorneys can use ___
evidence - ✔✔Circumstantial evidence
✔✔What does circumstantial evidence require? - ✔✔Finding OTHER clues associated
with the suspect's computer or location
✔✔What kind of evidence might this scenario be?
Computer has a password CONSISTENT with the password the suspect used on other
systems, a witness saw the suspect at the computer at the time the offense occurred, or
additional trace evidence associates the suspect with the computer at the time of the
incident - ✔✔Circumstantial Evidence
AND SOLUTIONS RATED A+
✔✔Collecting evidence according to the approved ___ of evidence control helps ensure
that the computer evidence is ____ - ✔✔- steps
- authentic
✔✔The FRE contains exceptions to providing ___ evidence - ✔✔Hearsay
✔✔The existence of these electronic files can't be disputed; however, their contents
require ____ testimony or ____ evidence - ✔✔- eyewitness testimony
- corroborating evidence
✔✔FRE Article VIII, Rule ___ cite EXCEPTIONS for when hearsay can be used -
✔✔Rule 802
✔✔Courts have consistently ruled that forensics investigators DON'T have to be subject
matter EXPERTS on what? - ✔✔The tools they use
✔✔US v. Salgado - ✔✔"It is NOT NECESSARY that the computer programmer testify in
order to authenticate computer-generated records."
✔✔The witness must have ___ - ___ knowledge only of facts RELEVANT to the case -
✔✔First-hand knowledge
✔✔If you have to TESTIFY about your role in acquiring, preserving, and analyzing
evidence, you DO NOT have to know the inner workings of the ____ you use, but you
SHOULD understand their ___ and ___ - ✔✔- Tools
- purpose and operation
✔✔You can safely testify that you DON'T KNOW ___ MD5 hashing alg works, but you
CAN ___ the steps for using the MD5 function in a specific tool - ✔✔- HOW
- describe
✔✔When attorneys challenge digital evidence, what is one test to prove that computer-
STORED records are authentic? - ✔✔Demonstrate that a specific PERSON created the
records
✔✔The author of a Microsoft Word doc can be identified using what? - ✔✔File metadata
✔✔Case that showed importance of file metadata: - ✔✔BTK Strangler
✔✔Software used to identify the metadata of a file: - ✔✔OSForensics Software
, ✔✔Is establishing who created digital evidence easy or hard? - ✔✔Hard
✔✔Records recovered from ___ space or ___ disk space usually DON'T IDENTIFY the
___. This also goes for ___ emails or text messages. - ✔✔- Slack space
- Unallocated disk space
- Author
- Anonymous
✔✔Unallocated Space - ✔✔Portions of a disk partition that DO NOT contain active data.
✔✔When a file on a hard drive containing data is ___, the data belonging to the file
REMAINS on the disk - ✔✔Deleted
✔✔The data part of a file remaining on a disk after a file is deleted? - ✔✔Unallocated
Space
✔✔Unallocated space is also called? - ✔✔Unallocated Clusters
✔✔How long does the data from a deleted file remain on the disk? - ✔✔Until it's
OVERWRITTEN by another file
✔✔Slack Space - ✔✔Space on a disk between the end-of-file marker and the end of the
cluster
✔✔Is it common or rare for file sizes to exactly match the size of 1 or multiple clusters
perfectly? - ✔✔Rare
✔✔Unused space on a disk - ✔✔Slack Space / Cluster
✔✔To establish authorship of digital evidence in these cases, attorneys can use ___
evidence - ✔✔Circumstantial evidence
✔✔What does circumstantial evidence require? - ✔✔Finding OTHER clues associated
with the suspect's computer or location
✔✔What kind of evidence might this scenario be?
Computer has a password CONSISTENT with the password the suspect used on other
systems, a witness saw the suspect at the computer at the time the offense occurred, or
additional trace evidence associates the suspect with the computer at the time of the
incident - ✔✔Circumstantial Evidence
