You have been asked to investigate after a user has reported a threatening e-mail they have
received from an external source. Which of the following are you most interested in when trying to
trace the source of the message?

You have completed a forensic investigation case. You would like to destroy the data contained in
various disks at the forensics lab due to sensitivity of the case. How would you permanently erase
the data on the hard disk?

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or
unique identifier of the machine that created the document. What is that code called?

When using Windows acquisitions tools to acquire digital evidence, it is important to use a welltested hardware write-blocking device to:

An Expert witness give an opinion if:

Printing under a Windows Computer normally requires which one of the following files types to be
created?

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator
from their various activity. After a computer has been compromised by a hacker, which of the
following would be most important in forming a profile of the incident?

To preserve digital evidence, an investigator should ____________________

What is the name of the Standard Linux Command that is also available as windows application
that can be used to create bit-stream images?

____________________ is simply the application of Computer Investigation and analysis
techniques in the interests of determining potential legal evidence.