Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?
intentional
Well Done. Your Answer is Correct Keep it Up!
functional
relational
temporal
Category: Cyber Security
The crime scene preservation process includes all but which of the following:
The crime scene preservation process includes all but which of the following:
confirming system date and time
Well Done. Your Answer is Correct Keep it Up!
controlling access to the crime scene
acquiring digital evidence
protecting against unauthorized alterations
The process model whose goal is to completely describe the flow of information in a digital investigation is known as:
The process model whose goal is to completely describe the flow of information in a digital investigation is known as:
the evidence flow model
Well Done. Your Answer is Correct Keep it Up!
the staircase model
the physical model
the subphase model
The first step in applying the scientific method to a digital investigation is to:
The first step in applying the scientific method to a digital investigation is to:
make one or more observations based on events that occurred
Well Done. Your Answer is Correct Keep it Up!
form a conclusion based on the results of your findings
experiment or test the available evidence to confirm or refute your prediction
form a theory on what may have occurred
Forensic analysis involves the following:
Forensic analysis involves the following:
assessment, experimentation, fusion, correlation, and validation
Well Done. Your Answer is Correct Keep it Up!
seizure and preservation
recovery, harvesting, filtering, organization, and search
All Options are Correct
An investigation can be hindered by the following:
An investigation can be hindered by the following:
All Options are Correct
Well Done. Your Answer is Correct Keep it Up!
preconceived theories
improperly handled evidence
offender concealment behavior
The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:
The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:
best evidence rule
Well Done. Your Answer is Correct Keep it Up!
due diligence
quid pro quo
voir dire
When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:
When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:
whether there are indications that the actual digital evidence was tampered with
Well Done. Your Answer is Correct Keep it Up!
whether chain of custody was maintained
whether the evidence was properly secured in transit
whether the evidence media was compatible with forensic machines
The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:
The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:
chain of custody
Well Done. Your Answer is Correct Keep it Up!
field notes
interim report
None of the Options are Correct
The following specializations exist in digital investigations:
The following specializations exist in digital investigations:
All Options are Correct
Well Done. Your Answer is Correct Keep it Up!
digital investigator
forensic examiner
first responder