Only need Solutions!

$01$

If a SIM card is found in the phone, it should be removed, imaged, and cloned. The cloned SIM card can be placed in the phone if needed.

A$.$ True

B$.$ False

$02$

Why should you remove the power directly from the back of the computer?

A$.$ You shouldn$$t $-$ be sure to remove the power from the wall.

B$.$ Removing the power cord at the wall may shock you

C$.$ There may be a UPS between the wall and the computer

D$.$ It is just easier

$03$

Because of the $5$th Amendment, a Law Enforcement Officer cannot ask for the password$/$passcode to a device.

A$.$ True

B$.$ False

$04$

When examining a digital device, one way an investigator can gain credibilty in the courtroom is to

A$.$ repeat the results to both the judge and the jury

B$.$ use a commercial tool, not a free one

C$.$ swear that the results are correct

D$.$ use more than one tool to substantiate their findings

$05$

When should you collect the system time from BIOS?

A$.$ Collect the system time first from the OS$,$ then compare it to the BIOS time

B$.$ Only after all storage media $($HDDs$,$ floppy disks, flash drives, optical media$)$ has been removed

C$.$ Boot to BIOS as soon as possible to record the information before you remove the HDD$,$ which may change it

D$.$ Use a CLI command using the OS to show the BIOS information

$06$

What would your computer display as the capacity $(2$ decimal places$)$ of a hard drive with the following information:

$19378$ cylinders, $16$ heads, $63$ spt

$07$

What capacity would a manufacturer put on the label of a hard drive with the following information:

$19378$ cylinders, $16$ heads, $63$ spt

$08$

What would your computer display as the capacity $(2$ decimal places$)$ of a hard drive with the following information:

LBA : $58592745$

$09$

What would a manufacturer put on the label of a hard drive with the following information:

LBA : $39082176$

$10$

What is a formal document prepared by a forensics specialist to document an investigation, including a list of all tests conducted?

A$.$ Curriculum vitae $($CV$)$

B$.$ Expert witness

C$.$ Rules of evidence

D$.$ Expert report

$11$

In a forensics lab, the machines being examined should not be connected to the Internet.

A$.$ True

B$.$ False

$12$

A$($n$)(?)$ should include all the tools you can afford to take to the field.

A$.$ extensive$-$response field kit

B$.$ forensic lab

C$.$ initial$-$response field kit

D$.$ forensic workstation

$13$

The $(?)$ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software.

A$.$ FS$-$TST

B$.$ NSRL

C$.$ CFTT

D$.$ NIST

$14$

Law enforcement investigators need a$($n$)(?)$ to remove computers from a crime scene and transport them to a lab.

A$.$ FOIA form

B$.$ evidence custody form

C$.$ affidavit

D$.$ warrant

$15$

$(?)$ can be software or hardware and are used to protect evidence disks by preventing data from being written to them.

A$.$ Write$-$blockers

B$.$ Workstations

C$.$ Drive$-$imaging

D$.$ Disk editors