Multiple Choice Questions
1. Which of the following is not an objective of a computer forensic investigation?
a. To identify the perpetrator(s) of a crime or other type of malfeasance.
b. To locate and recover data relating to a crime or civil matter.
c. To reconstruct damaged databases and files.
d. All of the above could be objectives of a computer forensic investigation.

2. What happens when data are logically deleted from a hard drive?
a. They can be undeleted.
b. They can be recovered with special software.
c. They can be undeleted only if they are not overwritten.
d. They are not recoverable.

3. If a forensic accountant investigates a computer containing a critical file that is known to be highly encrypted but open, what should the forensic accountant do?
a. Pull the plug on the computer.
b. Perform an orderly shutdown on the computer.
c. Make an immediate shadow volume copy of the entire hard drive.
This would not help, since the copy would be encrypted.
d. Browse the open file.

4. If a forensic accountant is called to investigate a computer that has been used by a probable terrorist, what should the accountant do?
a. Immediately seal off the area, pull the plug on the computer, and call the police.
b. Immediately seal off the area and call the police.
c. Immediately pull the plug, seal off the area, and call the police.
d. None of the above.

5. Which of these is true for data on a hard drive that are deleted and overwritten?
a. Not recoverable from the hard drive.
b. Recoverable from the hard drive if undeleted.
c. Possibly recoverable from the hard drive with special software.
d. Definitely recoverable from the hard drive with special hardware.