NO.42 A company has identified that a hacker has modified files on one of the company’s computers. The IT department has collected the storage media from the hacked computer.
Which evidence should be obtained from the storage media to identify which files were modified?

NO.43 The following line of code is an example of how to make a forensic copy of a suspect drive:
dd if=/dev/mem of=/evidence/image.memory1
Which operating system should be used to run this command?

NO.44 How do forensic specialists show that digital evidence was handled in a protected, secure manner during the process of collecting and analyzing the evidence?

NO.45 The human resources manager of a small accounting firm believes he may have been a victim of a phishing scam. The manager clicked on a link in an email message that asked him to verify the logon credentials for the firm’s online bank account.
Which digital evidence should a forensic investigator collect to investigate this incident?

NO.46 A forensic scientist arrives at a crime scene to begin collecting evidence.
What is the first thing the forensic scientist should do?

NO.47 A company has identified that a hacker has modified files on one of the company’s computers. The IT department has collected the storage media from the hacked computer.
Which evidence should be obtained from the storage media to identify which files were modified?

NO.48 A police detective investigating a threat traces the source to a house. The couple at the house shows the detective the only computer the family owns, which is in their son’s bedroom. The couple states that their son is presently in class at a local middle school.
How should the detective legally gain access to the computer?

NO.49 How should a forensic scientist obtain the network configuration from a Windows PC before seizing it from a crime scene?

NO.50 Which policy is included in the CAN-SPAM Act?

NO.51 Which Windows component is responsible for reading the boot.ini file and displaying the boot loader menu on Windows XP during the boot process?

NO.52 Which technique allows a cybercriminal to hide information?

NO.53 Which characteristic applies to solid-state drives (SSDs) compared to magnetic drives?

NO.54 The chief information security officer of a company believes that an attacker has infiltrated the company’s network and is using steganography to communicate with external sources. A security team is investigating the incident. They are told to start by focusing on the core elements of steganography.
What are the core elements of steganography?

NO.55 A computer involved in a crime is infected with malware. The computer is on and connected to the company’s network. The forensic investigator arrives at the scene.
Which action should be the investigator’s first step?

NO.56 What are the three basic tasks that a systems forensic specialist must keep in mind when handling evidence during a cybercrime investigation?

NO.57 Which storage format is a magnetic drive?

NO.58 A forensic specialist is about to collect digital evidence from a suspect’s computer hard drive. The computer is off.
What should be the specialist’s first step?

NO.59 Which tool should a forensic investigator use to determine whether data are leaving an organization through steganographic methods?

NO.60 An employee sends an email message to a fellow employee. The message is sent through the company’s messaging server.
Which protocol is used to send the email message?

NO.61 A cybercriminal communicates with his compatriots using steganography. The FBI discovers that the criminal group uses white space to hide data in photographs.
Which tool can the cybercriminals use to facilitate this type of communication?

NO.62 Which forensics tool can be used to bypass the passcode of an Apple iPhone running the iOS operating system?

NO.63 Which description applies to the Advanced Forensic Format (AFF)?

NO.64 A USB flash drive was seized as evidence to be entered into a trial.
Which type of evidence is this USB flash drive?

NO.65 Which law includes a provision permitting the wiretapping of VoIP calls?