Guide to Computer Forensics and Investigations, 5e, 9781285060033
Ch. 1 Solutions-1
Chapter 1
Review Questions
1. Digital forensics and data recovery refer to the same activities. True or False?
2. Police in the United States must use procedures that adhere to which of the following?
3. The triad of computing security includes which of the following?
4. What’s the purpose of maintaining a network of digital forensics specialists?
5. Policies can address rules for which of the following?
6. List two items that should appear on a warning banner.
7. Under normal circumstances, a private-sector investigator is considered an agent of law enforcement.
True or False?
8. List two types of digital investigations typically conducted in a business environment.
9. What is professional conduct, and why is it important?
10. What’s the purpose of an affidavit?
11. What are the necessary components of a search warrant?
12. What are some ways to determine the resources needed for an investigation?
13. List three items that should be on an evidence custody form.
14. Why should you do a standard risk assessment to prepare for an investigation?
15. You should always prove the allegations made by the person who hired you. True or False?
16. For digital evidence, an evidence bag is typically made of antistatic material. True or False?
17. Why should evidence media be write-protected?
18. List three items that should be in your case report.
19. Why should you critique your case after it’s finished?
20. What do you call a list of people who have had physical possession of the evidence?
21. Data collected before an attorney issues a memo for an attorney-client privilege case is
protected under the confidential work product rule. True or False?
Hands-On Projects
Hands-On Project 1-1
Students should extract two files with the Copy File feature: a spreadsheet listing several accounts and a
Hands-On Project 1-2
Students should use the Content Search and Cluster Search tabs in the Search dialog box and enter the
keyword “book.” Their memos should describe the filename and cluster location of each hit. Students
should find approximately 24 hits.
Hands-On Project 1-3
This project allows students to practice keyword searches and shows that the information they seek might
not be in obvious places. In this project, for example, the account number students need to locate is in the
Guide to Computer Forensics and Investigations, 5e, 9781285060033
Ch. 1 Solutions-3
Hands-On Project 1-4
The project shows students how to extract specific data—in this case, files that haven’t been deleted in an
image.
Hands-On Project 1-5
Students practice selecting unallocated files and then generating a report.
Hands-On Project 1-6
Students need to apply all the skills they learned in the chapter to do this project on searching for keywords.
Case Projects
Case Project 1-1
Case Project 1-2
Most likely, Jonathan needs his computer to do other things in his business. Students need to acquire an
Case Project 1-3
Students need to ask who else had access to the computer, find out whether the firm that fired her did its
own investigation, and determine whether they can have access to the images. If no investigation has been
done, students should state whether they can make copies now.
Case Project 1-4
Students need to find out which OS she was using and ask whether she knows the names of essential files