During the course of a corporate investigation, you find that an Employee is committing a crime.
Can the Employer file a criminal complain with Police?

The ____________________ refers to handing over the results of private investigations to the
authorities because of indications of criminal activity.

This organization maintains a database of hash signatures for known software:

One technique for hiding information is to change the file extension from the correct one to one
that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc
extension so that a picture file appears to be a document. What can an investigator examine to
verify that a file has the correct extension?

You are employed directly by an attorney to help investigate an alleged sexual harassment case at
a large pharmaceutical manufacture. While at the corporate office of the company, the CEO
demands to know the status of the investigation. What prevents you from discussing the case with
the CEO?

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from
the compromised system. Melanie did a DOS copy of all the files on the system. What would be
the primary reason for you to recommend a disk imaging tool?

What information do you need to recover when searching a victims computer for a crime
committed with specific e-mail message?

One way to identify the presence of hidden partitions on a suspects hard drive is to:

What does mactime, an essential part of the coroners toolkit do?

Chris has been called upon to investigate a hacking incident reported by one of his clients. The
company suspects the involvement of an insider accomplice in the attack. Upon reaching the
incident scene, Chris secures the physical area, records the scene using visual mediA. He shuts
the system down by pulling the power plug so that he does not disturb the system in any way. He
labels all cables and connectors prior to disconnecting any. What do you think would be the next
sequence of events?