COMPUTER FORENSICS CENGAGE FINAL TEST 2026/2027 | STUDY GUIDE,
PRACTICE QUESTIONS, ANSWERS & EXAM REVIEW
The law of search and seizure protects the rights of all people, excluding people suspected of crimes. -
ANS ✔✔False
Which group often works as part of a team to secure an organization's computers and networks? - ANS
✔✔Forensics investigators
What is the main information being sought when examining e-mail headers? - ANS ✔✔The originating e-
mail's domain name or an IP address
Which agency introduced training on software for forensics investigations by the early 1990s? - ANS
✔✔IACIS
Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack. - ANS ✔✔True
Expert opinions cannot be presented without stating the underlying factual basis. - ANS ✔✔False
The first 5 bytes (characters) for all MFT records are FILE. - ANS ✔✔False
What resource might attorneys use to search for information on expert witnesses? - ANS ✔✔Deposition
banks
Corporate investigators always have the authority to seize all computer equipment during a corporate
investigation. - ANS ✔✔False
What cloud application offers a variety of cloud services, including automation and CRM, cloud
application development, and Web site marketing? - ANS ✔✔Salesforce
What term refers to a person using a computer to perform routine tasks other than systems
administration? - ANS ✔✔End user
Evidence artifacts vary depending on the social media channel and the device. - ANS ✔✔True
To retrieve e-mail headers in Microsoft Outlook, what option should be clicked after the e-mail has been
selected? - ANS ✔✔File, Properties
To help determine which computer forensics tool to purchase, a comparison table of functions,
subfunctions, and vendor products is useful. - ANS ✔✔True
Which activity involves determining how much risk is acceptable for any process or operation? - ANS
✔✔Risk management
What is Microsoft's SkyDrive now called? - ANS ✔✔OneDrive
, Research on wearable computers has been conducted at MIT labs for more than a decade, and these
computers are now moving into working reality. - ANS ✔✔True
As an expert witness, you can't testify if you weren't present when the event occurred. - ANS ✔✔False
Which type of forensics can help you determine whether a system is truly under attack or a user has
inadvertently installed an untested patch or custom program? - ANS ✔✔Network forensics
Which document is sworn to under oath and penalty of perjury, or a comparable false swearing statute?
- ANS ✔✔A written report
Whether you're serving as an expert witness or a fact witness, be professional and polite when
presenting yourself to any attorney or the court. - ANS ✔✔True
What is the most common and flexible data-acquisition method? - ANS ✔✔Disk-to-image file copy
Which type of digital network divides a radio frequency into time slots? - ANS ✔✔TDMA
Besides presenting facts, reports can communicate expert opinion. - ANS ✔✔True
The Enhanced Data GSM Environment (EDGE) standard was developed specifically for which type of
service? - ANS ✔✔3G
A technician is trying to recover information on a computer that has been hidden or deleted on purpose
in order to hide evidence of a crime. Which type of task is the technician performing? - ANS ✔✔Data
recovery
What should you use to verify evidence and thus ensure its integrity? - ANS ✔✔Hash algorithms
Which tool enables the investigator to acquire the forensic image and process it in the same step? - ANS
✔✔Magnet AXIOM
From a network forensics standpoint, there are no potential issues related to using virtual machines. -
ANS ✔✔False
If a graphics file cannot be opened in an image viewer, what should the next step be? - ANS
✔✔Examining the file's header data
What type of acquisition is typically done on a computer seized during a police raid? - ANS ✔✔Static
A verbal report is more structured than a written report. - ANS ✔✔False
What Linux command is used to create the raw data format? - ANS ✔✔dd
The lab manager sets up processes for managing cases and reviews them regularly. - ANS ✔✔True
One way to examine a partition's physical level is to use a disk editor, such as WinHex, or Hex Workshop.
- ANS ✔✔True
PRACTICE QUESTIONS, ANSWERS & EXAM REVIEW
The law of search and seizure protects the rights of all people, excluding people suspected of crimes. -
ANS ✔✔False
Which group often works as part of a team to secure an organization's computers and networks? - ANS
✔✔Forensics investigators
What is the main information being sought when examining e-mail headers? - ANS ✔✔The originating e-
mail's domain name or an IP address
Which agency introduced training on software for forensics investigations by the early 1990s? - ANS
✔✔IACIS
Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack. - ANS ✔✔True
Expert opinions cannot be presented without stating the underlying factual basis. - ANS ✔✔False
The first 5 bytes (characters) for all MFT records are FILE. - ANS ✔✔False
What resource might attorneys use to search for information on expert witnesses? - ANS ✔✔Deposition
banks
Corporate investigators always have the authority to seize all computer equipment during a corporate
investigation. - ANS ✔✔False
What cloud application offers a variety of cloud services, including automation and CRM, cloud
application development, and Web site marketing? - ANS ✔✔Salesforce
What term refers to a person using a computer to perform routine tasks other than systems
administration? - ANS ✔✔End user
Evidence artifacts vary depending on the social media channel and the device. - ANS ✔✔True
To retrieve e-mail headers in Microsoft Outlook, what option should be clicked after the e-mail has been
selected? - ANS ✔✔File, Properties
To help determine which computer forensics tool to purchase, a comparison table of functions,
subfunctions, and vendor products is useful. - ANS ✔✔True
Which activity involves determining how much risk is acceptable for any process or operation? - ANS
✔✔Risk management
What is Microsoft's SkyDrive now called? - ANS ✔✔OneDrive
, Research on wearable computers has been conducted at MIT labs for more than a decade, and these
computers are now moving into working reality. - ANS ✔✔True
As an expert witness, you can't testify if you weren't present when the event occurred. - ANS ✔✔False
Which type of forensics can help you determine whether a system is truly under attack or a user has
inadvertently installed an untested patch or custom program? - ANS ✔✔Network forensics
Which document is sworn to under oath and penalty of perjury, or a comparable false swearing statute?
- ANS ✔✔A written report
Whether you're serving as an expert witness or a fact witness, be professional and polite when
presenting yourself to any attorney or the court. - ANS ✔✔True
What is the most common and flexible data-acquisition method? - ANS ✔✔Disk-to-image file copy
Which type of digital network divides a radio frequency into time slots? - ANS ✔✔TDMA
Besides presenting facts, reports can communicate expert opinion. - ANS ✔✔True
The Enhanced Data GSM Environment (EDGE) standard was developed specifically for which type of
service? - ANS ✔✔3G
A technician is trying to recover information on a computer that has been hidden or deleted on purpose
in order to hide evidence of a crime. Which type of task is the technician performing? - ANS ✔✔Data
recovery
What should you use to verify evidence and thus ensure its integrity? - ANS ✔✔Hash algorithms
Which tool enables the investigator to acquire the forensic image and process it in the same step? - ANS
✔✔Magnet AXIOM
From a network forensics standpoint, there are no potential issues related to using virtual machines. -
ANS ✔✔False
If a graphics file cannot be opened in an image viewer, what should the next step be? - ANS
✔✔Examining the file's header data
What type of acquisition is typically done on a computer seized during a police raid? - ANS ✔✔Static
A verbal report is more structured than a written report. - ANS ✔✔False
What Linux command is used to create the raw data format? - ANS ✔✔dd
The lab manager sets up processes for managing cases and reviews them regularly. - ANS ✔✔True
One way to examine a partition's physical level is to use a disk editor, such as WinHex, or Hex Workshop.
- ANS ✔✔True
