What information do you need to recover when searching a victim computer for a crime committed with specific e-mail message?

When monitoring for both intrusion and security events between multiple computers, it is essential that the computers’ clocks are synchronized.
Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers.
Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace.

What is the name of the service used to synchronize time among multiple computers?

Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any.

What do you think would be the next sequence of events?

What is the first step taken in an investigation for laboratory forensic staff members?

What encryption technology is used on Blackberry devices Password Keeper?

An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer.

Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

Which program is the boot loader when Windows XP starts up?

Sectors in hard disks typically contain how many bytes?

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well- tested hardware write-blocking device to _________