Quiz 4 Question 1)   __________ is offline analysis conducted on an evidence disk or forensic duplicate after booting from a CD or another system

Quiz 4

Question 1)

__________ is offline analysis conducted on an evidence disk or forensic duplicate after booting from a CD or another system.

Question 2 

Two of the easiest things to extract during __________ are a list of all website uniform resource locators (URLs) and a list of all email addresses on the computer.

Question 3

Windows uses __________ on each system as a "scratch pad" to write data when additional random access memory (RAM) is needed.

Question 4 

__________ contains remnants of word processing documents, emails, Internet browsing activity, database entries, and almost any other work that has occurred during past Windows sessions.

Question 5 

People try to thwart investigators by using encryption to scramble information or _________ to hide information, or both together.

Question 6 

What was designed as an area where computer vendors could store data that is shielded from user activities and operating system utilities, such as delete and format?

Question 7 

This is the space that remains on a hard drive if the partitions do not use all the available space.

Question 8 

EIDE is _______

Question 9 

What uses microchips that retain data in non-volatile memory chips and contains no moving parts?

Question 10 

What is the definition of hash?

Question 11

What term describes analysis performed on an evidence disk or a forensic duplicate using the native operating system?

Question 12 

What term describes data that an operating system creates and overwrites without the computer user directly saving this data?

Question 13 

_______ is the area of a hard drive that has never been allocated for file storage.

Question 14 

What kind of data changes rapidly and may be lost when the machine that holds it is powered down?

Question 15 

Which of the following is NOT true of chain of custody forms?

Question 16 

Jim is a forensic specialist. He seized a suspect computer from a crime scene, removed the hard drive and bagged it, documented and labeled the equipment, took photographs, completed a chain of custody form, and locked the computer in his car. On the way to the lab, he stopped to purchase supplies to use at the next crime scene. What did Jim do wrong?

Question 17 

What are attributes of a solid-state drive (SSD)?

Question 18 

The __________ format is a proprietary file format defined by Guidance Software for use in its forensic tool to store hard drive images and individual files.

Question 19 

An example of volatile data is __________.

Question 20 

Before imaging a drive, you must forensically wipe the target drive to ensure no residual data remains.