1.

Corporate investigations are typically easier than law enforcement investigations for which of the following reasons?

• a.
• Most companies keep inventory databases of all hardware and software used.
• b.
• The investigator doesn't have to get a warrant.
• c.
• The investigator has to get a warrant.
• d.
• Users can load whatever they want on their machines.

2.

In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a corporate investigator can conduct covert surveillance on an employee with little cause. True or False?

3.

If you discover a criminal act, such as murder or child pornography, while investigating a corporate policy abuse, the case becomes a criminal investigation and should be referred to law enforcement. True or False?

4.

As a corporate investigator, you can become an agent of law enforcement when which of the following happens? (Choose all that apply.)

• a.
• You begin to take orders from a police detective without a warrant or subpoena.
• b.
• Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement.
• c.
• Your internal investigation begins.
• d.
• None of the above.

5.

The plain view doctrine in computer searches is well-established law. True or False?

6.

If a suspect computer is located in an area that might have toxic chemicals, you must do which of the following? (Choose all that apply.)

• a.
• Coordinate with the HAZMAT team.
• b.
• Determine a way to obtain the suspect computer.
• c.
• Assume the suspect computer is contaminated.
• d.
• Do not enter alone.

7.

What are the three rules for a forensic hash?

8.

In forensic hashes, a collision occurs when ______________________.

9.

List three items that should be in an initial-response field kit.

10.

When you arrive at the scene, why should you extract only those items you need to acquire evidence?

11.

Computer peripherals or attachments can contain DNA evidence. True or False?

12.

If a suspect computer is running Windows 2000, which of the following can you perform safely?

• a.
• Browsing open applications
• b.
• Disconnecting power
• c.
• Either of the above
• d.
• None of the above

13.

Describe what should be videotaped or sketched at a computer crime scene.

14.

Which of the following techniques might be used in covert surveillance?

• a.
• Keylogging
• b.
• Data sniffing
• c.
• Network logs

15.

Commingling evidence means what in a corporate setting?

 

 

 

1.

In DOS and Windows 9.x, Io.sys is the first file loaded after the ROM bootstrap loader finds the disk. True or False?

2.

On a Windows system, sectors typically contain how many bytes?

• a.
• 256
• b.
• 512
• c.
• 1024
• d.
• 2048

3.

What does CHS stand for?

4.

Zoned bit recording is how disk manufacturers ensure that a platter's outer tracks store as much data as possible. True or False?

5.

Areal density refers to which of the following?

• a.
• Number of bits per disk
• b.
• Number of bits per partition
• c.
• Number of bits per square inch of a disk platter
• d.
• Number of bits per platter

6.

Clusters in Windows always begin numbering at what number?

7.

What is the ratio of sectors per cluster in a floppy disk?

• a.
• 1:1
• b.
• 2:1
• c.
• 4:1
• d.
• 8:1

8.

List three items stored in the FAT database.

9.

Windows 2000 can be configured to access which of these file formats? (Choose all that apply.)

• a.
• FAT12
• b.
• FAT16
• c.
• FAT32
• d.
• NTFS

10.

In FAT32, a 123 KB file uses how many sectors?

11.

What is the space on a drive called when a file is deleted? (Choose all that apply.)

• a.
• Disk space
• b.
• Unallocated space
• c.
• Drive space
• d.
• Free space

12.

List two features NTFS has that FAT does not.

13.

What does MFT stand for?

14.

In NTFS, files smaller than 512 bytes are stored in the MFT. True or False?

15.

RAM slack can contain passwords. True or False?