CTC 328 Final Exam 2025 Questions and
Answers
The is responsible for analyzing data and determining when another specialist should be called
in to assist with analysis.
a. Digital Evidence Specialist
b. Digital Evidence Analyst
c Digital Evidence Examiner
d. Digital Evidence First Responder - ANS Digital Evidence Specialist
What tool, currently maintained by tha IRS Criminal Investigation Division and limited to use by
law enforcement, can analyze and read special files that are copies ot a disk?
a. ILook
b. Photorec
c. DeepScan
d. AccessData Forensic Toolkit - ANS ILook
Which option below is not a standard systems analysis step?
a. Mitigate or minimize the risks.
b Obtain and copy an evidence drive
c Share evidence with experts outside of the investigation.
Pg. 1 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
,d. Determine a preliminary design or approach to the case. - ANS Share evidence with
experts outside of the investigation.
A chain-of-evidence form, which is used to document what has and has not been done with the
original evidence and forensic copies of the evidence, is also known as a(n)
Answers:
a. evidence tracking form
b. evidence custody form
c single-evidence form
d. multi-evidence form - ANS evidence custody form
All suspected industrial espionage cases should be treated as civil case investigations. True or
False - ANS false
must be Included in an affidavit to support an allegation in order to justify a warrant Answers:
a. Exhibits
b. Witnesses
c. Verdicts
d. Subpoenas - ANS exhibits
Within a computing investigation, the ability to perform a series of steps again and again to
produce the same results IS known as
a. verifiable reporting
b repeatable findings
c. reloadable steps
Pg. 2 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
,d evidence repofiing - ANS repeatable findings
Which amendment to the U.S. Constitution protects everyone's right to be secure in their
person, residence, and property from search and seizure?
a Fifth Amendment
b Second Amendment
C First Amendment
d Fourth Amendment - ANS Fourth Amendment
Most digital investigations in the private sector involve misuse of computing assets
True
False - ANS true
The sale of sensitive or confidential company information to a competitor is known as
a industrial betrayal
b industrial espionage
c industrial sabotage
d industrial collusion - ANS industrial espionage
Which option below is not a standard systems analysis step?
a. Mitigate or minimize the risks
b. Obtain and copy an evidence drive.
c Determine a preliminary design or approach to the case.
Pg. 3 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
, d Share evidence with experts outside of the investigation. - ANS Share evidence with
experts outside of the investigation.
A chain-of-evidence form, which is used to document what has and has not been done with the
original evidence and torensic copies ot the evidence, is also known as a(n)
a evidence tracking form
b evidence custody form
c emulti-evidence torm
d.single-evidence torm - ANS evidence custody form
The is not one of the three stages of a typical criminal case
a. complaint
b. prosecution
c investigation
d civil suit - ANS civil suit
is not recommended for a digital forensics workstation. Answers:
a A write-blocker device
b Remote access software
C A text editor tool
d An SCSI card - ANS Remote access software
According to the national institute of standards and technology (NIST), digital forensics involves
scientifically examimng and analyzing data trom computer storage media so that it can be used
as evidence in court_ tit - ANS false
Pg. 4 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
Answers
The is responsible for analyzing data and determining when another specialist should be called
in to assist with analysis.
a. Digital Evidence Specialist
b. Digital Evidence Analyst
c Digital Evidence Examiner
d. Digital Evidence First Responder - ANS Digital Evidence Specialist
What tool, currently maintained by tha IRS Criminal Investigation Division and limited to use by
law enforcement, can analyze and read special files that are copies ot a disk?
a. ILook
b. Photorec
c. DeepScan
d. AccessData Forensic Toolkit - ANS ILook
Which option below is not a standard systems analysis step?
a. Mitigate or minimize the risks.
b Obtain and copy an evidence drive
c Share evidence with experts outside of the investigation.
Pg. 1 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
,d. Determine a preliminary design or approach to the case. - ANS Share evidence with
experts outside of the investigation.
A chain-of-evidence form, which is used to document what has and has not been done with the
original evidence and forensic copies of the evidence, is also known as a(n)
Answers:
a. evidence tracking form
b. evidence custody form
c single-evidence form
d. multi-evidence form - ANS evidence custody form
All suspected industrial espionage cases should be treated as civil case investigations. True or
False - ANS false
must be Included in an affidavit to support an allegation in order to justify a warrant Answers:
a. Exhibits
b. Witnesses
c. Verdicts
d. Subpoenas - ANS exhibits
Within a computing investigation, the ability to perform a series of steps again and again to
produce the same results IS known as
a. verifiable reporting
b repeatable findings
c. reloadable steps
Pg. 2 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
,d evidence repofiing - ANS repeatable findings
Which amendment to the U.S. Constitution protects everyone's right to be secure in their
person, residence, and property from search and seizure?
a Fifth Amendment
b Second Amendment
C First Amendment
d Fourth Amendment - ANS Fourth Amendment
Most digital investigations in the private sector involve misuse of computing assets
True
False - ANS true
The sale of sensitive or confidential company information to a competitor is known as
a industrial betrayal
b industrial espionage
c industrial sabotage
d industrial collusion - ANS industrial espionage
Which option below is not a standard systems analysis step?
a. Mitigate or minimize the risks
b. Obtain and copy an evidence drive.
c Determine a preliminary design or approach to the case.
Pg. 3 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
, d Share evidence with experts outside of the investigation. - ANS Share evidence with
experts outside of the investigation.
A chain-of-evidence form, which is used to document what has and has not been done with the
original evidence and torensic copies ot the evidence, is also known as a(n)
a evidence tracking form
b evidence custody form
c emulti-evidence torm
d.single-evidence torm - ANS evidence custody form
The is not one of the three stages of a typical criminal case
a. complaint
b. prosecution
c investigation
d civil suit - ANS civil suit
is not recommended for a digital forensics workstation. Answers:
a A write-blocker device
b Remote access software
C A text editor tool
d An SCSI card - ANS Remote access software
According to the national institute of standards and technology (NIST), digital forensics involves
scientifically examimng and analyzing data trom computer storage media so that it can be used
as evidence in court_ tit - ANS false
Pg. 4 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
