ques cmit forensics

Question 1 (5 points)

Saved

Unicode is a binary representation of characters that is compatible with ASCII but includes fewer characters overall.

Question 2 (5 points)

If you change the file extension for an image file to .txt, the contents of the file cannot be displayed and will become unusable.

Question 3 (5 points)

The bit pattern 01000011 can be used to represent a single ASII character, a base ten number, or a CPU instruction.

Question 4 (5 points)

A hexadecimal editor can be used to search a hard drive to find passwords or keywords occurring outside of files or inside files in file slack space.

Question 5 (5 points)

If the file signature does not match the file extension, the contents of the file cannot be displayed.

Question 6 (5 points)

How many ASCII characters can be stored in 32 bits?

Question 7 (5 points)

How many hexadecimal digits are required to represent 32 bits of data?

Question 8 (5 points)

Which of the following file types contain images and/or graphics?

Question 9 (5 points)

Which of the following file extensions should contain executable code?

Question 10 (5 points)

Which of the following types of drives can be used as a forensic boot device?

Question 11 (5 points)

A write blocker is a hardware device or software application used to prevent the operating system from changing the contents of a hard drive.

Question 12 (5 points)

Which of the following is not a standard BIOS function?

Question 13 (5 points)

The Master Boot Record contains executable code, the disk signature, and the partition table for the disk.

Question 14 (5 points)

Which of the following is a valid signature word for an MBR?

Question 15 (5 points)

What is the length of the partition table in the MBR?

Question 16 (5 points)

POST is the last step in the boot process.

Question 17 (5 points)

In big Endian storage schemes, the most significant byte of a data value is stored at the smallest address. In little Endian storage schemes, the least significant byte of a data value is stored at the smallest address.

Question 18 (5 points)

What does CHS refer to?

Question 19 (5 points)

FAT file systems have a variable number of bits per entry in the Master File Table.

Question 20 (5 points)

In a Microsoft Windows operating system, the last access times for files are accurate to within two milliseconds.

Question 21 (10 points)

Digital forensics labs should prepare specialized operating procedures for each case.

Question 22 (10 points)

Evidence tags are affixed to computer equipment and removable media upon receipt at the digital forensics lab. This ensures that evidence can be tracked using a chain of custody form.

Question 23 (10 points)

Organizations are required to properly preserve any and all forms of electronic media which can be reasonably anticipated to be relevant to current or future litigation.

Question 24 (10 points)

A corporate policy for digital forensics should address requirements found in which of the following laws?

Question 25 (10 points)

Corporate audit procedures should be followed during cyber forensic investigations in cases where the subject is suspected of having committed financial fraud.

Question 26 (10 points)

Case management includes all of the following EXCEPT:

Question 27 (10 points)

Evidence being shipped inter-city or across state lines should always be shipped in the airline’s cargo hold to protect against the risk of loss or theft during transfer.

Question 28 (10 points)

Which of the following is not a recommended method for verifying the analysis and results of a forensic examination?

Question 29 (10 points)

Every digital forensics lab should have both a policy and a procedure regarding sanitization of media prior to use for forensic imaging.

Question 30 (10 points)

Which of the following is not a NIST mandated feature or capability of a forensic tool?

Question 31 (10 points)

What type of cryptography can be used to find and identify files containing child pornography?

Question 32 (10 points)