WGU C702 Tools and Rules

Rules of Forensic Investigation - CORRECT ANSWER Safeguard the integrity of the evidence and render it acceptable in a court of law. The forensic examiner must make duplicate copies of the original evidence. The duplicate copies must be accurate replications of the originals, and the forensic examiner must also authenticate the duplicate copies to avoid questions about the integrity of the evidence. Must not continue with the investigation if the examination is going to be beyond his or her knowledge level or skill level. Admissible evidence - CORRECT ANSWER Evidence that can be legally and properly introduced in a civil or criminal trial. Evidence is relevant to the case Authentic Evidence - CORRECT ANSWER Evidence that is in its original or genuine state. Investigators must provide supporting documents regarding the authenticity, accuracy, and integrity of the evidence Complete Evidence - CORRECT ANSWER Evidence must either prove or disprove the fact Reliable Evidence - CORRECT ANSWER evidence that possesses a sufficient degree of likelihood that it is true and accurate Evidence must be proven dependable when the evidence was extracted Believable Evidence - CORRECT ANSWER Evidence must be presented in a clear manner and expert opinions must be obtained where necessary Rules of Evidence - CORRECT ANSWER Rules governing the admissibility of evidence in trial courts. Best Evidence Rule - CORRECT ANSWER states that secondary evidence, or a copy, is inadmissible in court when the original exists. Duplicate evidence will suffice under the following conditions: -Original evidence is destroyed due to fire or flood -Original evidence is destroyed in the normal course of business -Original evidence is in possession of a third party Fourth Amendment - CORRECT ANSWER Protects against unreasonable search and seizure. Government agents may not search or seize areas or things in which a person has reasonable expectation of privacy, without a search warrant. Rule 101 - CORRECT ANSWER Scope - These rules govern proceedings in the courts of the United States and before United States bankruptcy judges and United States magistrate judges, to the extent and with the exceptions stated in rule 1101. Rule 102 - CORRECT ANSWER Purpose and Construction - These rules shall be construed to secure fairness in administration, elimination of unjustifiable expense and delay, and promotion of growth and development of the law of evidence to the end that the truth may be ascertained and proceedings justly determined. Rule 105 - CORRECT ANSWER Limited Admissibility - When evidence that is admissible as to one party or for one purpose but not admissible as to another party or for another purpose is admitted, the court, upon ITProTV Video Notes for CHFI v9 request, shall restrict the evidence to its proper scope and instruct the jury accordingly Rule 801 - CORRECT ANSWER "Hearsay" means a statement that: (1) the declarant does not make while testifying at the current trial or hearing; and (2) a party offers in evidence to prove the truth of the matter asserted in the statement. Rule 1002 - CORRECT ANSWER Requirement of the Original - An original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise. Rule 1003 - CORRECT ANSWER Admissibility of Duplicates - A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original's authenticity or the circumstances make it unfair to admit the duplicate. Rule 1004 - CORRECT ANSWER Admissibility of Other Evidence of Content Scientific Working Group on Digital Evidence (SWGDE) - CORRECT ANSWER brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as to ensure quality and consistency within the forensic community. FRED - CORRECT ANSWER Acquires data directly from hard drives and storage devices Paraben's StrongHold - CORRECT ANSWER blocks out wireless signals PC-3000 Data Extractor - CORRECT ANSWER Diagnoses and fixes file system issues, so data can be obtained Paraben's Chat Stick - CORRECT ANSWER Thumb drive devices; searches the entire computer and scan for chat logs RAPID IMAGE 7020 X2 - CORRECT ANSWER Copy one "Master" hard drive to up to 19 "Target" hard drives RoadMASSter-3 X2 - CORRECT ANSWER Ruggedized portable lab for HDD data acquisition and analysis. ZX-Tower - CORRECT ANSWER Secure sanitization of hard disk Data Recovery Stick - CORRECT ANSWER Recovers deleted files Tableau T8-R2 Forensic USB Bridge - CORRECT ANSWER Write blocking of USB storage devices Cain & Abel - CORRECT ANSWER Password recovery for Windows OS Recuva - CORRECT ANSWER Recover lost pictures, music, docs, video, email. Recover all types of lost files from disk or removable media Capsa - CORRECT ANSWER Sniffer R-Drive Image - CORRECT ANSWER Creation of disk image files for backup FileMerlin - CORRECT ANSWER Converts word processing to a wide range of file formats AccessData FTK - CORRECT ANSWER Court-cited digital investigations platform provides processing and indexing up front EnCase - CORRECT ANSWER Rapidly acquire data and unearth potential evidence with disk-level forensic analysis The Sleuth Kit - CORRECT ANSWER Command line tools to analyz