Title: Module 2 Quiz
Course: CAP 2140 Digital Forensics > Section: Understanding Computer Investigations

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: When preparing a case, you can apply ____ to problem solving.
- standard programming rules
- standard police investigation
- standard systems analysis steps
- bottom-up analysis
A: standard systems analysis steps

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: The ____ is the route the evidence takes from the time you find it until the case is closed or goes to court.
- acquisition plan
- chain of custody
- evidence path
- evidence custody
A: chain of custody

Q: The basic plan for your investigation includes gathering the evidence, establishing the ____, and performing the forensic analysis.
- risk assessment
- nature of the case
- chain of custody
- location of the evidence
A: chain of custody

Q: The list of problems you normally expect in the type of case you are handling is known as the ____.
- standard risk assessment
- chain of evidence
- standard problems form
- problems checklist form
A: standard risk assessment

Q: Use ____ to secure and catalog the evidence contained in large computer components.
- Hefty bags
- regular bags
- paper bags
- evidence bags
A: evidence bags

Q: A(n) ____ helps you document what has and has not been done with both the original evidence and forensic copies of the evidence.
- evidence custody form
- risk assessment form
- initial investigation form
- evidence handling form
A: evidence custody form

Q: ____ investigations typically include spam, inappropriate and offensive message content, and harassment or threats.
- VPN
- Internet
- E-mail
- Phone
A: E-mail

Q: ____ prevents damage to the evidence as you transport it to your secure evidence locker, evidence room, or computer lab.
- An antistatic wrist band
- Padding
- An antistatic pad
- Tape
A: Padding

Q: You can use ____ to boot to Windows without writing any data to the evidence disk.
- a SCSI boot up disk
- a Windows boot up disk
- a write-blocker
- Windows XP
A: a write-blocker

Q: To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as a ____.
- mobile workstation
- forensic workstation
- forensic lab
- recovery workstation
A: forensic workstation

Q: A ____ is a bit-by-bit copy of the original storage medium.
- preventive copy
- recovery copy
- backup copy
- bit-stream copy
A: bit-stream copy

Q: To begin conducting an investigation, you start by ____ the evidence using a variety of methods.
- copying
- analyzing
- opening
- reading
A: copying

Q: A bit-stream copy is a bit-by-bit duplicate of the original disk. You should use the original disk whenever possible.
- true
- false
A: false

Q: Many attorneys like to have printouts of the data you have recovered, but printouts can present problems when you have log files with several thousand pages of data.
- true
- false
A: true

Q: When you are dealing with password protected files, you might need to acquire ____________________ or find an expert who can help you crack the passwords.
A: password-cracking software

Q: During the ____________________ design or approach to the case, you outline the general steps you need to follow to investigate the case.
A: preliminary

Q: What additional items are useful when setting up a forensic workstation?

Q: What are the items you need when setting up your workstation for computer forensics?