The ____________________ refers to handing over the results of private investigations to the authorities
because of indications of criminal activity.

This organization maintains a database of hash signatures for known software.

One technique for hiding information is to change the file extension from the correct one to one that might not
be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture fileappears to be a document. What can an investigator examine to verify that a file has the correct extension?

You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large
pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the
status of the investigation. What prevents you from discussing the case with the CEO?

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the
compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary
reason for you to recommend a disk imaging tool?

What information do you need to recover when searching a victim’s computer for a crime committed with
specific e-mail message?

One way to identify the presence of hidden partitions on a suspect’s hard drive is to:

What does mactime, an essential part of the coroner’s toolkit do?

The use of warning banners helps a company avoid litigation by overcoming an employee assumed
__________________________. When connecting to the company’s intranet, network or Virtual Private
Network(VPN) and will allow the company’s investigators to monitor, search and retrieve information stored
within the network.

Chris has been called upon to investigate a hacking incident reported by one of his clients. The company
suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris
secures the physical area, records the scene using visual media. He shuts the system down by pulling the
power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to
disconnecting any. What do you think would be the next sequence of events?