CHAPTER 09 DIGITAL FORENSICS ANALYSIS AND
VALIDATION UPDATED ACTUAL QUESTIONS WITH
CORRECT ANSWERS
Question 1.
The defense request for full discovery of digital evidence applies only to criminal cases in the
United States.
ANSWER
True
Question 2.
For target drives, use only recently wiped media that have been reformatted and inspected for
computer viruses.
ANSWER
True
Question 3.
Autopsy for Windows cannot perform forensics analysis on FAT file systems.
ANSWER
False
Question 4.
Autopsy for Windows cannot analyze data from image files from other vendors.
ANSWER
False
Question 5.
When viewing two files that look the same, but one has an invisible digital watermark, they
appear to be the same file, except for their sizes.
ANSWER
False
Question 6.
____ increases the time and resources needed to extract, analyze, and present evidence.
ANSWER
Scope creep
1
, Question 7.
You begin a digital forensics case by creating a(n) ____.
ANSWER
investigation plan
Question 8.
In civil and criminal cases, the scope is often defined by search warrants or ____, which specify
what data you can recover.
ANSWER
subpoenas
Question 9.
To enhance searching for and eliminating known OS and application files, Autopsy has an
indexed version of the NIST ____ of MD5 hashes.
ANSWER
NSRL
Question 10.
____ have some limitations in performing hashing, however, so using advanced ____ is
necessary to ensure data integrity.
ANSWER
Digital forensics tools, hexadecimal editors
Question 11.
AccessData ____ compares known file hash values to files on your evidence drive or image files
to see whether they contain suspicious data.
ANSWER
KFF
Question 12.
Data ____ involves changing or manipulating a file to conceal information.
ANSWER
hiding
2
VALIDATION UPDATED ACTUAL QUESTIONS WITH
CORRECT ANSWERS
Question 1.
The defense request for full discovery of digital evidence applies only to criminal cases in the
United States.
ANSWER
True
Question 2.
For target drives, use only recently wiped media that have been reformatted and inspected for
computer viruses.
ANSWER
True
Question 3.
Autopsy for Windows cannot perform forensics analysis on FAT file systems.
ANSWER
False
Question 4.
Autopsy for Windows cannot analyze data from image files from other vendors.
ANSWER
False
Question 5.
When viewing two files that look the same, but one has an invisible digital watermark, they
appear to be the same file, except for their sizes.
ANSWER
False
Question 6.
____ increases the time and resources needed to extract, analyze, and present evidence.
ANSWER
Scope creep
1
, Question 7.
You begin a digital forensics case by creating a(n) ____.
ANSWER
investigation plan
Question 8.
In civil and criminal cases, the scope is often defined by search warrants or ____, which specify
what data you can recover.
ANSWER
subpoenas
Question 9.
To enhance searching for and eliminating known OS and application files, Autopsy has an
indexed version of the NIST ____ of MD5 hashes.
ANSWER
NSRL
Question 10.
____ have some limitations in performing hashing, however, so using advanced ____ is
necessary to ensure data integrity.
ANSWER
Digital forensics tools, hexadecimal editors
Question 11.
AccessData ____ compares known file hash values to files on your evidence drive or image files
to see whether they contain suspicious data.
ANSWER
KFF
Question 12.
Data ____ involves changing or manipulating a file to conceal information.
ANSWER
hiding
2
