Reference no: EM132175406
CHAPTER REVIEW QUESTIONS
Computer Evidence
1. What is a hash verification used for when conducting a computer examination?
2. When imaging a computer drive, what should be used to prevent contamination of the evidence?
3. Where should you always check for evidence in an operating system desktop?
4. When documenting a forensic examination in a report, what information about a file should be included in the report?
Mobile Device Evidence
1. What is the IMEI or MEID of a device and what is the difference between the two?
2. What type of memory is used in mobile devices?
3. How do you prevent contamination of evidence on a mobile device?
4. The ICCID number is found on what component of a mobile device?
5. What is the IMSI, where is the IMSI store on the mobile device, and what is it used for?
6. Where is the content data from modern applications stored?
Forensic Records Analysis
1. What is the element/site, sector/face, and azimuth refer to when reading subscriber detail records?
2. What is call measurement data?
3. What is UTC and how do you convert it?
4. What Federal Law permits the acquisition of subscriber records for criminal cases?