An Expert witness give an opinion if: A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors B. To define the issues of the case for determination by the finder of fact C. To stimulate discussion between the consulting expert and the expert witness […]

Printing under a Windows Computer normally requires which one of the following files types to be created? A. EME B. MEM C. EMF D. CME

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident? A. The manufacturer of the system compromised B. The logic, formatting and […]

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images? A. mcopy B. image C. MD5 D. dd

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police? A. Yes, and all evidence can be turned over to the police B. Yes, but only if you turn the evidence over to a federal law enforcement agency C. No, […]

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm’s employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their […]

This organization maintains a database of hash signatures for known software. A. International Standards Organization B. Institute of Electrical and Electronics Engineers C. National Software Reference Library D. American National standards Institute

You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO? A. the attorney-work-product rule B. Good manners […]

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool? A. A disk imaging tool would check for […]

What information do you need to recover when searching a victim’s computer for a crime committed with specific e-mail message? A. Internet service provider information B. E-mail header C. Username and password D. Firewall log