312-49v10 practice questions, page 23 of 34, with answer review and explanations.
Question 111
To preserve digital evidence, an investigator should ____________________.
Make two copies of each evidence item using a single imaging tool
Make a single copy of each evidence item using an approved imaging tool
Make two copies of each evidence item using different imaging tools
Only store the original evidence item
Question 112
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
The manufacturer of the system compromised
The logic, formatting and elegance of the code used in the attack
The nature of the attack
The vulnerability exploited in the incident
Question 113
Printing under a Windows Computer normally requires which one of the following files types to be created?
EME
MEM
EMF
CME
Question 114
An Expert witness give an opinion if:
The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
To define the issues of the case for determination by the finder of fact
To stimulate discussion between the consulting expert and the expert witness
To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
Question 115
When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to: