1.

List two organizations mentioned in the chapter that provide computer forensics training.

2.

Computer forensics and data recovery refer to the same activities. True or False?

3.

Police in the United States must use procedures that adhere to which of the following?

• a.
• Third Amendment
• b.
• Fourth Amendment
• c.
• First Amendment
• d.
• None of the above

4.

The triad of computing security includes which of the following?

• a.
• Detection, response, and monitoring
• b.
• Vulnerability assessment, detection, and monitoring
• c.
• Vulnerability assessment, intrusion response, and investigation
• d.
• Vulnerability assessment, intrusion response, and monitoring

5.

List three common types of digital crime.

6.

A corporate investigator must follow Fourth Amendment standards when conducting an investigation. True or False?

7.

What is the purpose of maintaining a network of computer forensics specialists?

8.

Policies can address rules for which of the following?

• a.
• When you can log on to a company network from home
• b.
• The Internet sites you can or cannot access
• c.
• The amount of personal e-mail you can send
• d.
• Any of the above

9.

List two items that should appear on an internal warning banner.

10.

Warning banners are often easier to present in court than policy manuals are. True or False?

11.

Under normal circumstances, a corporate investigator is considered an agent of law enforcement. True or False?

12.

List two types of computer investigations typically conducted in the corporate environment.

13.

What is professional conduct and why is it important?

14.

What is the purpose of maintaining a professional journal?

15.

Laws and procedures for PDAs are which of the following?

• a.
• Well established
• b.
• Still being debated
• c.
• On the law books
• d.
• None of the above

 

 

 

1.

What are some initial assessments you should make for a computing investigation?

2.

What are some ways to determine the resources needed for an investigation?

3.

List three items that should be on an evidence custody form.

4.

Why should you do a standard risk assessment to prepare for an investigation?

5.

You should always prove the allegations made by the person who hired you. True or False?

6.

For digital evidence, an evidence bag is typically made of antistatic material. True or False?

7.

Who should have access to a secure container?

• a.
• Only the primary investigator
• b.
• Only the investigators in the group
• c.
• Everyone on the floor
• d.
• Only senior-level management

8.

For employee termination cases, what types of investigations do you typically encounter?

9.

Why should your evidence media be write-protected?

10.

List three items that should be in your case report.

11.

Why should you critique your case after it's finished?

12.

What do you call a list of people who have had physical possession of the evidence?

13.

What two tasks is an acquisitions officer responsible for at a crime scene?

14.

What are some reasons that an employee might leak information to the press?

15.

When might an interview turn into an interrogation?