You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

• A.The SMTP reply Address
• B.The E-mail Header
• C.The X509 Address
• D.The Host Domain Name

Comment: *

Name: *

Email: *

Verification: *

When discussing the chain of custody in an investigation, what does a link refer to?

• A.Someone that takes possession of a piece of evidence
• B.The most critical piece of evidence in an investigation
• C.Evidence that links one piece of evidence to another, like a usb cable
• D.The transportation used when moving evidence

Comment: *

Name: *

Email: *

Verification: *

Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob? testimony in this case?

• A.Certification
• B.Authentication
• C.Justification
• D.Reiteration

Comment: *

Name: *

Email: *

Verification: *

A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?

• A.They tampered with evidence by using it
• B.They attempted to implicate personnel without proof
• C.They called in the FBI without correlating with the fingerprint data
• D.They examined the actual evidence on an unrelated system

Comment: *

Name: *

Email: *

Verification: *

What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

• A.Reserved file
• B.Encrypted file
• C.Data stream file
• D.Compressed file

Comment: *

Name: *

Email: *

Verification: *