Guide to Computer Forensics and Investigations, 5e
Ch. 16 Solutions-1
Chapter 16 Solutions
Review Questions
1. Describe two types of ethical standards.
2. Ethical obligations are duties that you owe only to others. True or
False?
3. List three sound reasons for offering a different opinion from one
you testified to in a previous case.
4. List three or more factors courts have used in determining whether
to disqualify an expert.
Answers can include the following: whether the attorney informed the
expert that their discussions were confidential, whether the expert reviewed
5. All expert witnesses must be members of associations that license
them. True or False?
6. Contingency fees can be used to compensate an expert under
which circumstances?
7. List three organizations that have a code of ethics or conduct.
Guide to Computer Forensics and Investigations, 5e
Ch. 16 Solutions-2
8. In the United States, no state or national licensing body
specifically licenses forensics examiners. True or False?
9. When you begin a conversation with an attorney about a specific
case, what should you do? (Choose all that apply.)
10. What purpose does making your own recording during a
deposition serve?
11. Externally enforced ethical rules, with sanctions that can restrict a
professional’s practice, are more accurately described as which of
the following?
12. Describe an unethical technique opposing counsel might use to
make a deposition difficult for you.
13. What are some risks of using tools you have created yourself?
14. List four steps you should take, in the correct order, to handle a
deposition in which physical circumstances are uncomfortable.
1. Ask the attorney to correct the situation.
15. List three obvious ethical errors.
Answer can include the following:
▪ Don’t present false data or alter data.
Guide to Computer Forensics and Investigations, 5e
Ch. 16 Solutions-3
▪ Don’t report work that was not done.
16. Codes of professional conduct or responsibility set the highest
standards for professionals’ expected performance. True or False?
Hands-On Projects
Hands-On Project 16-1
Students should be able to find two occurrences of BAIDAR~1.xls in the
pagefile.sys file. The first occurrence is at offset 0x2F0; this file can’t be
recovered. The second occurrence is at offset 0x14D0; this file can be recovered.
For each file’s date and time stamps, see the chapter’s solution spreadsheet,
C16-DataRuns.xlsx.
Hands-On Project 16-2
Students should be able to find tourguide.doc in the ProDiscover deleted
Hands-On Project 16-3
Students should produce the following date and time for the Kayak4.jpg file:
Hands-On Project 16-4
Guide to Computer Forensics and Investigations, 5e
Ch. 16 Solutions-4
Case Projects
Case Project 16-1
Students might want to consult examples of other organizations’ codes of
Case Project 16-2
Students should list sources they drew on in creating their personal codes and
Case Project 16-3
Students’ critiques should state the organization’s priorities and examine each
item of expected behavior. Their papers should include a statement of whether
the organization’s code serves only its members or society’s needs, too.
Case Project 16-4
In this continuation of Case Project 16-2, students should critique their own
Case Project 16-5
Students’ opinion papers should use the evidence collected from the in-chapter
activities and hands-on projects. They should note whether the date and time