Computer Forensics and Investigations Ch.4

Guide to Computer Forensics and Investigations Ch. 4 Solutions-1 Chapter 4 Solutions Review Questions 1. Private-sector investigations are typically easier than law enforcement investigations for which of the following reasons? 2. In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a private-sector investigator can conduct covert surveillance on an employee with little cause. True or False? 3. If you discover a criminal act while investigating a company policy abuse, the case becomes a criminal investigation and should be referred to law enforcement. True or False? 4. As a private-sector investigator, you can become an agent of law enforcement when which of the following happens? (Choose all that apply.) a. Most companies keep inventory databases of all hardware and software used. True True a. You begin to take orders from a police detective without a warrant or subpoena. b. Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement. 5. The plain view doctrine in computer searches is well-established law. True or False? 6. If a suspect’s computer is found in an area that might have toxic chemicals, you must do which of the following? (Choose all that apply.) False a. Coordinate with the HAZMAT team. c. Assume the suspect’s computer is contaminated. 7. What are the three rules for a forensic hash? It can’t be predicted, no two files can have the same hash value, and if the file changes, the hash value changes. 8. In forensic hashes, when does a collision occur? 9. List three items that should be in an initial-response field kit. When two different files have the same hash value Answers can include small computer toolkit, large-capacity drive, IDE ribbon cables, forensic boot media, laptop IDE 40-to-44 pin adapter, laptop or portable computer, FireWire or USB dual write-protect external bay, flashlight, digital camera or 35mm camera, evidence log forms, notebook or dictation recorder, evidence bags (antistatic bags for digital devices), evidence labels, tape, tags, permanent ink marker, USB drives, or large portable hard drive 10. When you arrive at the scene, why should you extract only those items you need to acquire evidence? To minimize how much you have to keep track of at the scene 11. Computer peripherals or attachments can contain DNA evidence. True or False? True Guide to Computer Forensics and Investigations Ch. 4 Solutions-2 12. If a suspect computer is running Windows 10, which of the following can you perform safely? a. Browsing open applications 13. Describe what should be videotaped or sketched at a digital crime scene. Computers, mobile devices, cable connections, overview of scene—anything that might be of interest to the investigation 14. Which of the following techniques might be used in covert surveillance? (Choose all that apply.) a. Keylogging b. Data sniffing 15. Commingling evidence means what in a private-sector setting? Sensitive or confidential information being mixed with data collected as evidence 16. List two hashing algorithms commonly used for forensics purposes. MD5 and SHA-1 17. Small companies rarely need investigators. True or False? False 18. If a company doesn’t distribute a computing use policy stating an employer’s right to inspect employees’ computers freely, including e-mail and Web use, employees have an expectation of privacy. True or False? True 19. You have been called to the scene of a fatal car crash where a laptop computer is still running. What type of field kit should you take with you? Initial-response field kit 20. You should always answer questions from onlookers at a crime scene. True or False? False