CIS 484 Exam Question and answers
rated A+ 2026/2027
Public Sector Investigations - correct answer ✔Digital investigations fall into two categories:
• Public-sector investigations
• Private-sector investigations
Public-sector investigations involve government agencies responsible for
criminal investigations and prosecution
When conducting public-sector investigations, you must understand laws on
computer-related crimes including:
• Standard legal processes
• Guidelines on search and seizure
• How to build a criminal case
Public-sector and private-sector investigations differ; public-sector typically
require search warrants before seizing digital evidence
Private Sector Investigations - correct answer ✔Private-sector investigations focus more on policy
violations
Private-sector investigations involve private companies and lawyers who
address company policy violations and litigation disputes
• Example: wrongful termination
,Private-sector crimes can involve:
• E-mail harassment, falsification of data, gender and age discrimination,
embezzlement, sabotage, and industrial espionage
Businesses can reduce the risk of litigation by publishing and maintaining
policies that employees find easy to read and follow
• Most important policies define rules for using the company's computers and
networks
• Known as an "Acceptable use policy"
• Line of authority - states who has the legal right to initiate an investigation,
who can take possession of evidence, and who can have access to evidence
Business can avoid litigation by displaying a warning banner on computer
screens
• Informs end users that the organization reserves the right to inspect computer
systems and network traffic at will
During private investigations, you search for evidence to support allegations of
violations of a company's rules or an attack on its assets
• Three types of situations are common:
• Abuse or misuse of computing assets
• E-mail abuse
• Internet abuse
• A private-sector investigator's job is to minimize risk to the company
, Live Imaging - correct answer ✔Capturing an image while
booted into the target
computer's operating system
If you won't be able to decrypt the image, one option is live imaging the C:\ logical volume
Dead Imaging - correct answer ✔• Capturing an image while the
suspect's operating system is
not running
• Involves pulling hard drive or
using bootable operating system
• Not always possible/practical
DD/Raw images - correct answer ✔Makes it possible to write bit-stream data to files
Advantages
• Most computer forensics tools and many non-forensic tools can read raw format
Disadvantages
• Requires as much storage as original disk or data
• Verification pass can be slower
Proprietary Image Formats - correct answer ✔Digital container file for forensic image
Advantages
• Ability to enable compression
• Can integrate metadata into the image file: examiner name, case number,
etc.
rated A+ 2026/2027
Public Sector Investigations - correct answer ✔Digital investigations fall into two categories:
• Public-sector investigations
• Private-sector investigations
Public-sector investigations involve government agencies responsible for
criminal investigations and prosecution
When conducting public-sector investigations, you must understand laws on
computer-related crimes including:
• Standard legal processes
• Guidelines on search and seizure
• How to build a criminal case
Public-sector and private-sector investigations differ; public-sector typically
require search warrants before seizing digital evidence
Private Sector Investigations - correct answer ✔Private-sector investigations focus more on policy
violations
Private-sector investigations involve private companies and lawyers who
address company policy violations and litigation disputes
• Example: wrongful termination
,Private-sector crimes can involve:
• E-mail harassment, falsification of data, gender and age discrimination,
embezzlement, sabotage, and industrial espionage
Businesses can reduce the risk of litigation by publishing and maintaining
policies that employees find easy to read and follow
• Most important policies define rules for using the company's computers and
networks
• Known as an "Acceptable use policy"
• Line of authority - states who has the legal right to initiate an investigation,
who can take possession of evidence, and who can have access to evidence
Business can avoid litigation by displaying a warning banner on computer
screens
• Informs end users that the organization reserves the right to inspect computer
systems and network traffic at will
During private investigations, you search for evidence to support allegations of
violations of a company's rules or an attack on its assets
• Three types of situations are common:
• Abuse or misuse of computing assets
• E-mail abuse
• Internet abuse
• A private-sector investigator's job is to minimize risk to the company
, Live Imaging - correct answer ✔Capturing an image while
booted into the target
computer's operating system
If you won't be able to decrypt the image, one option is live imaging the C:\ logical volume
Dead Imaging - correct answer ✔• Capturing an image while the
suspect's operating system is
not running
• Involves pulling hard drive or
using bootable operating system
• Not always possible/practical
DD/Raw images - correct answer ✔Makes it possible to write bit-stream data to files
Advantages
• Most computer forensics tools and many non-forensic tools can read raw format
Disadvantages
• Requires as much storage as original disk or data
• Verification pass can be slower
Proprietary Image Formats - correct answer ✔Digital container file for forensic image
Advantages
• Ability to enable compression
• Can integrate metadata into the image file: examiner name, case number,
etc.
