Title: Final Exam
Course: CAP 2141 Digital Forensics II > Section: Module 8 Ethics for the Expert Witness

Q: A(n) ____ hearing generally addresses the administrative agency’s subject matter and seeks evidence in your testimony on a subject for which it’s contemplating making a rule.
- administrative
- judicial
- legislative
- direct
A: administrative

Q: There are two types of depositions: ____ and testimony preservation.
- examination
- discovery
- direct
- rebuttal
A: discovery

Q: Discuss any potential problems with your attorney ____ a deposition.
- before
- after
- during
- during direct examination at
A: before

Q: Sometimes opposing attorneys ask several questions inside one question; this practice is called ____ questions.
- leading
- hypothetical
- compound
- rapid-fire
A: compound

Q: A ____ differs from a trial testimony because there is no jury or judge.
- rebuttal
- plaintiff
- civil case
- deposition
A: deposition

Q: ____ questions can give you the factual structure to support and defend your opinion.
- Setup
- Compound
- Rapid-fire
- Hypothetical
A: Hypothetical

Q: Attorneys search ____ for information on expert witnesses.
- disqualification banks
- deposition banks
- examination banks
- cross-examination banks
A: deposition banks

Q: Computer forensics examiners have two roles: scientific/technical witness and ____ witness.
- expert
- direct
- discovery
- professional
A: expert

Q: The most important laws applying to attorneys and witnesses are the ____.
- professional codes of conduct
- rules of ethics
- rules of evidence
- professional ethics
A: rules of evidence

Q: ____ are the experts who testify most often.
- Civil engineers
- Computer forensics experts
- Chemical engineers
- Medical professionals
A: Medical professionals

Q: ____ offers the most comprehensive regulations of any professional organization and devote an entire section to forensics activities.
- AMA’s law
- ABA’s Model Rule
- APA’s Ethics Code
- ABA’s Model Codes
A: APA’s Ethics Code

Q: The ____ Ethics Code cautions psychologists about the limitations of assessment tools.
- ABA’s
- APA’s
- AMA’s
- ADA’s
A: APA’s

Q: FRE ____ describes whether the expert is qualified and whether the expert opinion can be helpful.
- 702
- 703
- 704
- 705
A: 702

Q: FRE ____ describes whether basis for the testimony is adequate.
- 700
- 701
- 702
- 703
A: 703

Q: The ABA’s ____ contains provisions limiting the fees experts can receive for their services.
- Code 703
- Model Code
- Rule 26
- Code 26-1.a
A: Model Code

Q: The ____ has stated that, unlike attorneys, expert witnesses do not owe a duty of loyalty to their clients.
- ISFCE
- IACIS
- ABA
- HTCIA
A: ABA

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: You can use the ____ to help your attorney learn the terms and functions used in computer forensics.
- verbal report
- preliminary report
- final report
- examination plan
A: examination plan

Q: A written report is frequently a(n) ____ or a declaration.
- subpoena
- affidavit
- deposition
- perjury
A: affidavit

Q: Attorneys can now submit documents electronically in many courts; the standard format in federal courts is ____.
- Microsoft Word (DOC)
- Portable Document Format (PDF)
- Encapsulated Postscript (EPS)
- Postscript (PS)
A: Portable Document Format (PDF)

Q: A(n) ____ is a document that lets you know what questions to expect when you are testifying.
- written report
- affidavit
- examination plan
- subpoena
A: examination plan

Q: In the past, the method for expressing an opinion has been to frame a ____ question based on available factual evidence.
- hypothetical
- nested
- challenging
- contradictory
A: hypothetical

Q: An expert’s opinion is governed by FRE, Rule ____, and the corresponding rule in many states.
- 705
- 755
- 805
- 855
A: 705

Q: If a report is long and complex, you should provide a(n) ____.
- appendix
- glossary
- table of contents
- abstract
A: abstract

Q: A(n) ____ is sworn to under oath (and penalty of perjury or comparable false swearing statute).
- written report
- verbal report
- examination plan
- cross-examination report
A: written report

Q: The abstract should be one or two paragraphs totaling about 150 to ____ words.
- 200
- 250
- 300
- 350
A: 200

Q: ____ provide additional resource material not included in the body of the report.
- Conclusion
- References
- Discussion
- Appendixes
A: Appendixes

Q: Remember that anything you write down as part of your examination for a report is subject to ____ from the opposing attorney.
- subpoena
- discovery
- publishing
- deposition
A: discovery

Q: A written preliminary report is considered a ____ document because opposing counsel can demand discovery on it.
- low-risk
- middle-risk
- high-risk
- no-risk
A: high-risk

Q: Save broader generalizations and summaries for the report’s ____.
- appendixes
- introduction
- conclusion
- discussion
A: conclusion

Q: In the main section of your report, you typically cite references with the ____ enclosed in parentheses.
- year of publication and author’s last name
- author’s last name
- author’s last name and year of publication
- year of publication
A: author’s last name and year of publication

Q: A report using the ____ numbering system divides material into sections and restarts numbering with each main section.
- roman-sequential
- decimal
- legal-sequential
- indent
A: decimal

Q: Typically, report writers use one of two numbering systems: decimal numbering or ____ numbering.
- legal-sequential
- roman-sequential
- arabic-sequential
- letter-sequential
A: legal-sequential

Q: Files with extensions .ods and ____ are created using OpenOffice Calc.
- .sxc
- .xls
- .dcx
- .qpr
A: .sxc

Q: Reports and logs generated by forensic tools are typically in plaintext format, a word processor format, or ____ format.
- PDF
- HTML
- PS
- TXT
A: HTML

Q: If necessary, you can include ____ containing material such as raw data, figures not used in the body of the report, and anticipated exhibits.
- conclusions
- discussions
- references
- appendixes
A: appendixes

Q: The report’s ____ should restate the objectives, aims, and key questions and summarize your findings with clear, concise statements.
- abstract
- conclusion
- introduction
- reference
A: conclusion

Q: Files with extension ____ are created using Microsoft Outlook Express.
- .sxc
- .doc
- .dbx
- .ods
A: .dbx

Q: When you give ____ testimony, you present this evidence and explain what it is and how it was obtained.
- technical/scientific
- expert
- lay witness
- deposition
A: technical/scientific

Q: When cases go to trial, you as a forensics examiner can play one of ____ roles.
- 2
- 3
- 4
- 5
A: 2

Q: For forensics specialists, keeping the ____ updated and complete is crucial to supporting your role as an expert and showing that you’re constantly enhancing your skills through training, teaching, and experience.
- testimony
- CV
- examination plan
- deposition
A: CV

Q: Validate your tools and verify your evidence with ____ to ensure its integrity.
- hashing algorithms
- watermarks
- steganography
- digital certificates
A: hashing algorithms

Q: ____ is a written list of objections to certain testimony or exhibits.
- Defendant
- Empanelling the jury
- Plaintiff
- Motion in limine
A: Motion in limine

Q: If your CV is more than ____ months old, you probably need to update it to reflect new cases and additional training.
- 2
- 3
- 4
- 5
A: 3

Q: ____ from both plaintiff and defense is an optional phase of the trial. Generally, it’s allowed to cover an issue raised during cross-examination.
- Rebuttal
- Plaintiff
- Closing arguments
- Opening statements
A: Rebuttal

Q: Regarding a trial, the term ____ means rejecting potential jurors.
- voir dire
- rebuttal
- strikes
- venireman
A: strikes

Q: Jurors typically average just over ____ years of education and an eighth-grade reading level.
- 9
- 10
- 11
- 12
A: 12

Q: If a microphone is present during your testimony, place it ____ to eight inches from you.
- 3
- 4
- 5
- 6
A: 6

Q: ____ evidence is evidence that exonerates or diminishes the defendant’s liability.
- Rebuttal
- Plaintiff
- Inculpatory
- Exculpatory
A: Exculpatory

Q: Depending on your attorney’s needs, you might provide only your opinion and technical expertise to him or her instead of testifying in court; this role is called a(n) _______________________.
A: consulting expert

Q: FTK cannot analyze data from image files from other vendors.
- true
- false
A: false

Q: _____________________ is a pretrial motion to exclude certain evidence because it would prejudice the jury.
A: Motion in limine

Q: A nonsteganographic graphics file has a different size than an identical steganographic graphics file.
- true
- false
A: false

Q: Vendor-unique e-mail file systems, such as Microsoft .pst or .ost, typically use ____________________ formatting, which can be difficult to read with a text or hexadecimal editor.
A: Multipurpose Internet Mail Extensions (MIME) / Multipurpose Internet Mail Extensions / MIME / MIME (Multipurpose Internet Mail Extensions)

Q: For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses.
- true
- false
A: true

Q: The ______________________ of evidence supports the integrity of your evidence.
A: chain of custody

Q: In UNIX e-mail servers, the ____________________ file simply specifies where to save different types of e-mail log files.
A: syslog.conf

Q: FTK cannot perform forensics analysis on FAT12 file systems.
- true
- false
A: false

Q: Administrators usually set e-mail servers to ____________________ logging mode.
A: continuous

Q: An e-mail address in the Return-Path line of an e-mail header is usually indicated as the ____________________ field in an e-mail message.
A: Reply to

Q: The defense request for full discovery of digital evidence applies only to criminal cases in the United States.
- true
- false
A: true

Q: You can send and receive e-mail in two environments:via the ____________________ or an intranet (an internal network).
A: Internet

Q: At a trial, _____________________ are statements that organize the evidence and state the applicable law.
A: closing arguments

Q: The purpose of the _____________________ is for the opposing attorney to preview your testimony before trial.
A: deposition

Q: Describe how e-mail account names are created on an intranet environment.

Q: What are some of the technical definitions that you should prepare before your testimony?

Q: What are some of the reasons to avoid contact with news media during a case?

Q: What should you do when preparing for testimony?

Q: What are some of the questions you should consider when preparing your testimony?