Reference no: EM133901975
CHAPTER 10
REVIEW QUESTIONS
1. Define digital evidence in your understanding.
2. List the seven phases of crime scene processing and describe each phase in your understanding.
3. Preservation of a computer system configuration on scene and what the state of the computer was are very important items to document. List several ways you can document how a computer was set up and what it was doing at the time of the seizure.
4. why is it important to know if a computer is attached to a network/the Internet?
5. Why is it important to pull the power cord plug from the back of the computer as opposed to pulling the plug from the wall?
6. How is powering down a laptop different from powering down a desktop system?
7. What is the purpose of a write blocker and why is it important to a computer forensics specialist?
8. When a forensics specialist clones or copies a suspect hard disk drive or other data source, how can the specialist be sure an exact clone or duplicate is made?
9. List several things that could potentially harm digital evidence/computer data.
10. Can a deleted file be recovered? If so, why?
11. Most forensic software applications perform an indexing process on a suspect hard disk drive or data source. What benefits are there to this indexing?
12. Describe the Innocent Images National Initiative in your understanding.
13. What is encryption and why does it pose a challenge to investigators?