How many sectors will a 125 KB file use in a FAT32 file system?

• A.25
• B.32
• C.256
• D.16

Comment: *

Name: *

Email: *

Verification: *

Using Linux to carry out a forensics investigation, what would the following command accomplish?
dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

• A.Restore a disk from an image file
• B.Search for disk errors within an image file
• C.Copy a partition to an image file
• D.Backup a disk to an image file

Comment: *

Name: *

Email: *

Verification: *

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the
?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?

• A.The sequential number of the exhibits seized
• B.The year the evidence was taken
• C.The sequence number for the parts of the same exhibit
• D.The initials of the forensics analyst

Comment: *

Name: *

Email: *

Verification: *

What is the goal of forensic science?

• A.Save the good will of the investigating organization
• B.Mitigate the effects of the information security breach
• C.To determine the evidential value of the crime scene and related evidence
• D.It is a disciple to deal with the legal processes

Comment: *

Name: *

Email: *

Verification: *

A state department site was recently attacked, and all the servers had their hard disks erased. The incident response team sealed the area and commenced an investigation. During evidence collection, they came across a USB flash drive that did not have the standard labeling on it. The incident team inserted the flash drive into an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they shortlisted possible suspects including three summer interns. Where did the incident team go wrong?

• A.They examined the actual evidence on an unrelated system
• B.They called in the FBI without correlating with the fingerprint data
• C.They tampered with the evidence by using it
• D.They attempted to implicate personnel without proof

Comment: *

Name: *

Email: *

Verification: *