When it comes to mobile forensics, the micro-read (physical analysis) is the hardest and the most time consuming process of extracting data as versus manual extraction (physical analysis of the phone involving manual manipulation of the keyboard and photographic documentation of data displayed on the screen).

True

False

QUESTION 2

For which of the following reasons should you wipe (clean) a target device BEFORE you put a forensic image on it.

a		To make sure unwanted data isn't retained on the drive
b		Because it sounds like a good idea?
c		Because of a process called bit-shifting

QUESTION 12

Steganography is used for what following purpose?

a		Validating data
b		Hiding data
c		Accessing remote computers
d		Creating strong passwords

QUESTION 3

What are the two read/write blocker methods used in forensic data acquisitions?

		a Remote and logical
	b	Logical and local
	c	Logical and physical
	d	Hardware and software

QUESTION 4

If you forensically image a powered down computer then you will probably not get to see the RAM data as it is lost (although there is always the artifacts to examine e.g. hiberfil and pagefile artifacts)

True

False

QUESTION 5

A live acquisition of a running computer is preferred over imagining a powered down computer.

True

False