An Employee is suspected of stealing proprietary information belonging to your company that he
had no rights to possess. The information was stored on the Employees Computer that was
protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to
a floppy disk just before leaving work for the weekenD. You detain the Employee before he leaves
the building and recover the floppy disks and secure his computer. Will you be able to break the
encryption so that you can verify that that the employee was in possession of the proprietary
information?

What type of file is represented by a colon (:) with a name following it in the Master File Table of
NTFS disk?

In Microsoft file structures, sectors are grouped together to form:

While working for a prosecutor, What do you think you should do if the evidence you found
appears to be exculpatory and is not being released to the defense ?

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the
operating system inserts _______________ in the first letter position of the filename in the FAT
database.

When you carve an image, recovering the image depends on which of the following skills?

In General, ______________ Involves the investigation of data that can be retrieved from the hard
disk or other disks of a computer by applying scientific methods to retrieve the datA.

When conducting computer forensic analysis, you must guard against ______________ So that
you remain focused on the primary job and insure that the level of work does not increase beyond
what was originally expecteD.

Which of the following is NOT a graphics file?

You have used a newly released forensic investigation tool, which doesnt meet the Daubert T
est, during a case. The case has ended-up in court. What argument could the defense make to
weaken your case?