4- is created when a file is created if it does not take up an entire sector. 5-Criminal trials are often preceded by a(n) at which the admissibility of evidence is determined 6-A(n) is a reasonable belief that a person has committed a crime. 7-Care, control, and chain of custody are called the of evidence. Q3- Match the type of crime with its motive (2 Marks): 1. Fraud from computer billings A. Computer is the crime target II. Software piracy B. Computer is the crime instrument III. Theft of intellectual property C. Computer is incidental to traditional crime IV. illegal gambling D. New crime generated by prevalence of computers Answer: Q2. Fill in the Blank: (3 Marks): suppression hearing-three C-Steganography- File slack - probable cause-chain of custody - Science is important because it recognizes the field 1-The emphasis on computer forensics as a(n) as a discipline with set principles. 2-The is documentation that the evidence was handled and preserved properly. 3- is a term generally used to indicate a message is hidden within another file. 8. Which of the following statements best defines computer forensics? A. Computer forensics is the use of evidence to solve computer crimes. B. Computer forensics is the use of digital evidence to solve a crime. C. Computer forensics is only used to find deleted files on a computer. D. Computer forensics is only used to examine desktop and laptop computers. 9. A chain of custody (CoC) form is used to document which of the following? A. Law enforcement officers who arrest and imprison a criminal suspect B. A chain of letters or emails used in an investigation C. Anyone who has been in contact with evidence in a D. None of the above 10- Which of the following can be of evidentiary value to a computer forensics examiner? A. A SIM card B. An Xbox C. A digital camera D. All of the above Q1- Multiple choice: (5 Marks): 1-What type of program is available to delete and overwrite data on a computer? A. File-overwriting software B. File-deleting software C. File-wiping software D. All of the above 2-In order to be legally defensible, methods used in the recovery of data must ensure that A. The original evidence was not altered. B. No data was added to the original. C. No data was deleted from the original. D. All of the above 3-Which of the following is NOT considered one of the five stages of a computer investigation? A. Intelligence B. Hypothesis C. Conviction D. Conclusion 4-The chain of custody must include which of the following items? A. Where the evidence was stored B. The size of the containers used to store the evidence C. How heavy the evidence was when acquired D. The relevance of the evidence 5-Evidence collected in violation of which amendment will cause the evidence to be excluded? A. The Fourth Amendment B. The First Amendment C. The Ninth Amendment D. The Tenth Amendment B 6- Which of the following are required by forensic investigators? A. Their expertise Their objectivity C. Their problem-solving skills D. All are required 7- Criminal statutes define crimes in terms of required acts and a required state of mind, typically referred to as: A. The person's motivation B. The person's psychological makeup C. The person's needs at the time The person's intent D