What binary coding is used most often for e-mail purposes? A. MIME B. Uuencode C. IMAP D. SMTP

If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement? A. true B. false

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as: A. Inculpatory evidence B. Mandatory evidence C. Exculpatory […]

What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer? A. rootkit B. key escrow C. steganography D. Offset

What happens when a file is deleted by a Microsoft operating system using the FAT file system? A. only the reference to the file is removed from the FAT B. the file is erased and cannot be recovered C. a copy of the file is stored and the original file is erased D. the file […]

If a suspect computer is located in an area that may have toxic chemicals, you must: A. coordinate with the HAZMAT team B. determine a way to obtain the suspect computer C. assume the suspect machine is contaminated D. do not enter alone

When investigating a potential e-mail crime, what is your first step in the investigation? A. Trace the IP address to its origin B. Write a report C. Determine whether a crime was actually committed D. Recover the evidence

When monitoring for both intrusion and security events between multiple computers, it is essential that the computers’ clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. […]

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to […]

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case? A. evidence must be handled in the same way regardless of the type of case B. evidence procedures are not important unless you work for a law enforcement agency […]