CSCI 4611 Computer Forensics and Incident
Response Midterm questions with accurate
answers
-b Ans✓✓✓Quiz 3: The _______ switch can be used with the split
command to adjust the size of segmented volumes created by the dd
command.
.eve Ans✓✓✓Quiz 6: The ProDiscover utility makes use of the
proprietary _______________ file format.
/dev/sda Ans✓✓✓Quiz 3: An investigator wants to capture all data on a
SATA drive connected to a Linux system. What should the investigator
use for the "if=" portion of the dcfldd command?
$LogFile Ans✓✓✓Quiz 5: What metadata record in the MFT keeps
track of previous transactions to assist in recovery after a system failure
in an NTFS volume?
07 Ans✓✓✓Quiz 5: What hexadecimal code below identifies an NTFS
file system in the partition table?
0x1BE Ans✓✓✓Quiz 5: A Master Boot Record (MBR) partition table
marks the first partition starting at what offset?
,10 Ans✓✓✓Quiz 2: In order to qualify for the Certified Computer
Crime Investigator, Basic Level certification, candidates must provide
documentation of at least _______ cases in which they participated.
17025:2005 Ans✓✓✓Quiz 2: Which ISO standard below is followed
by the American Society of Crime Laboratory Directors (ASCLD)?
18 to 36 months Ans✓✓✓Quiz 2: How long are computing components
designed to last in a normal business environment?
2 GB Ans✓✓✓Quiz 3: When using a target drive that is FAT32
formatted, what is the maximum size limitation for split files?
40 Ans✓✓✓Quiz 2: In order to qualify for the Certified Computer
Forensic Technician, Basic Level certification, how many hours of
computer forensics training are required?
512 bytes Ans✓✓✓Quiz 5: A typical disk drive stores how many bytes
in a single sector?
90 Ans✓✓✓Quiz 2: What percentage of consumers utilize Intel and
AMD PCs?
A laptop computer built into a carrying case with a small selection of
peripheral options Ans✓✓✓Quiz 6: In general, what would a
lightweight forensics workstation consist of?
, A witness list Ans✓✓✓Quiz 1: An evidence custody form does not
usually contain _______.
acquisition Ans✓✓✓Quiz 6: The physical data copy subfunction exists
under the ______________ function.
Advanced Forensic Format (AFF) Ans✓✓✓Quiz 3: Which open-source
acquisition format is capable of producing compressed or uncompressed
image files, and uses the .afd extension for segmented image files?
Affidavit Ans✓✓✓Quiz 1: If a police officer or investigator has
sufficient cause to support a search warrant, the prosecuting attorney
might direct him or her to submit a(n) _______.
Allegation Ans✓✓✓Quiz 1: _______ describes an accusation of fact
that a crime has been committed.
Autopsy Ans✓✓✓Quiz 6: What program serves as the GUI front end
for accessing Sleuth Kit's tools?
B+-tree Ans✓✓✓Quiz 5: The ReFS storage engine uses a __________
sort method for fast access to large data sets.
BitLocker Ans✓✓✓Quiz 3: What is the name of the Microsoft solution
for whole disk encryption?
Response Midterm questions with accurate
answers
-b Ans✓✓✓Quiz 3: The _______ switch can be used with the split
command to adjust the size of segmented volumes created by the dd
command.
.eve Ans✓✓✓Quiz 6: The ProDiscover utility makes use of the
proprietary _______________ file format.
/dev/sda Ans✓✓✓Quiz 3: An investigator wants to capture all data on a
SATA drive connected to a Linux system. What should the investigator
use for the "if=" portion of the dcfldd command?
$LogFile Ans✓✓✓Quiz 5: What metadata record in the MFT keeps
track of previous transactions to assist in recovery after a system failure
in an NTFS volume?
07 Ans✓✓✓Quiz 5: What hexadecimal code below identifies an NTFS
file system in the partition table?
0x1BE Ans✓✓✓Quiz 5: A Master Boot Record (MBR) partition table
marks the first partition starting at what offset?
,10 Ans✓✓✓Quiz 2: In order to qualify for the Certified Computer
Crime Investigator, Basic Level certification, candidates must provide
documentation of at least _______ cases in which they participated.
17025:2005 Ans✓✓✓Quiz 2: Which ISO standard below is followed
by the American Society of Crime Laboratory Directors (ASCLD)?
18 to 36 months Ans✓✓✓Quiz 2: How long are computing components
designed to last in a normal business environment?
2 GB Ans✓✓✓Quiz 3: When using a target drive that is FAT32
formatted, what is the maximum size limitation for split files?
40 Ans✓✓✓Quiz 2: In order to qualify for the Certified Computer
Forensic Technician, Basic Level certification, how many hours of
computer forensics training are required?
512 bytes Ans✓✓✓Quiz 5: A typical disk drive stores how many bytes
in a single sector?
90 Ans✓✓✓Quiz 2: What percentage of consumers utilize Intel and
AMD PCs?
A laptop computer built into a carrying case with a small selection of
peripheral options Ans✓✓✓Quiz 6: In general, what would a
lightweight forensics workstation consist of?
, A witness list Ans✓✓✓Quiz 1: An evidence custody form does not
usually contain _______.
acquisition Ans✓✓✓Quiz 6: The physical data copy subfunction exists
under the ______________ function.
Advanced Forensic Format (AFF) Ans✓✓✓Quiz 3: Which open-source
acquisition format is capable of producing compressed or uncompressed
image files, and uses the .afd extension for segmented image files?
Affidavit Ans✓✓✓Quiz 1: If a police officer or investigator has
sufficient cause to support a search warrant, the prosecuting attorney
might direct him or her to submit a(n) _______.
Allegation Ans✓✓✓Quiz 1: _______ describes an accusation of fact
that a crime has been committed.
Autopsy Ans✓✓✓Quiz 6: What program serves as the GUI front end
for accessing Sleuth Kit's tools?
B+-tree Ans✓✓✓Quiz 5: The ReFS storage engine uses a __________
sort method for fast access to large data sets.
BitLocker Ans✓✓✓Quiz 3: What is the name of the Microsoft solution
for whole disk encryption?
