CSCI 511: Midterm Liberty University
CSCI 511: Midterm Liberty University
How can an investigator validate that he or she made an exact copy of a hard drive?
What is volatile memory analysis and what difficulties does it pose to the forensic investigator?
With the consistency checking file system repair technique, the computer’s file system is rebuilt from scratch using knowledge of an undamaged file system structure.
An individual cannot be compelled by authorities to reveal passwords to
computers or files. By doing so, the individual may incriminate himself or herself
A victim of a criminal act can sue the perpetrator for damages in civil court.
Modern cryptography is separated into two distinct groups: symmetric cryptography and asymmetric cryptography.
The Fourth Amendment applies to searches conducted by private individuals, businesses, and nongovernmental agencies.
When an individual connects to a wireless network, the service set identifier (SSID) is logged as a preferred network connection. This information can be found in the Windows Registry.
The term symmetric cryptography describes those methods where the same key is used to encrypt and decrypt the plaintext.
Real evidence means physical objects that can be touched, held, or directly observed, such as a laptop with a suspect’s fingerprints on it, or a handwritten note.
What is meant by slurred image?
The Windows Registry is organized into five sections. The section stores information about drag-and-drop rules, program shortcuts, the user interface, and related items.
What name is given to a protocol used to send e-mail that works on port 25?
is essentially data about the data. In the case of files, it can include creation time/date, size, last modified date, and even file header information.
The is a federal wiretap law for traditional wired telephony that was expanded to include wireless, voice over packet, and other forms of electronic communications, including signaling traffic and metadata.
Which of the following is the definition of anti-forensics?
Which of the following is the definition of inode?
What term is used to describe statements that govern whether, when, how, and why proof of a legal case can be placed before a judge or jury?
The unused space between the logical end of file and the physical end of file is known as .
What version of RAID are the following descriptors? Striped disks with dedicated parity combine three or more disks in a way that protects data against loss of any one disk. Fault tolerance is achieved by adding an extra disk to the array and dedicating it to storing parity information. The storage capacity of the array is reduced by one disk.
The contains many provisions about recordkeeping and destruction of electronic records relating to the management and operation of publicly held companies.
The field reveals the real IP address of the computer from which the email was originally sent from.
This field is intended for spam filtering.
The Windows Registry is organized into five sections. The section is very critical to forensic investigations. It has profiles for all the users, including their settings.
The is designed to protect children from exposure to indecent material.
is a live-system forensic technique in which you collect a memory dump and perform analysis in an isolated environment.
Under the Fourth Amendment, search warrants must:
There are specific laws in the United States that are applicable to e-mail
is used to prevent anything from being written to the hard drive or other data source:
The establishes a standard of information-handling practices that governs the collection, maintenance, use, and dissemination of information about individuals that is maintained in systems of records by U.S. federal agencies.
RFC 3864 describes message header field names. Information about how the message is to be displayed, usually a Multipurpose Internet Mail Extensions (MIME) type refers to which of the following options?
The field consists of the name of the server and a unique string that the sending e-mail server assigned to the message:
The standard of proof in a civil trial is:
The states that forensic tools, techniques, procedures and evidence are admissible in court only if they have a “general acceptance” within the scientific community.
There are specific laws in the United States that are applicable to e-mail investigations. is about perpetrators who attempt to hide the pornographic nature of their
Which of the following is the definition of the Daubert Standard?
Which of the following common e-mail header fields is commonly used with values “bulk,” “junk,” or “list”; or used to indicate that automated “vacation” or “out of office” responses should not be returned for the mail?
Maintaining is a problem with live system forensics in which data is not acquired at a unified moment.
What is meant by steganalysis?
Digital cameras contain a wealth of metadata in:
sets standards for digital evidence processing, analysis, and diagnostics.
What is Internet Message Access Protocol (IMAP)?
A number of tools and even some Windows utilities are available that can help you to analyze live data on a Windows system. can tell you system uptime (time since last reboot), operating system details, and other general information about the system.
occurs when a seller takes on various digital identities by opening up several email accounts and bids on his or her own items multiple times to prompt genuine bidders to provide a much higher bid for an item than they would have done otherwise.
The file allocation table is really a list of entries that map to each on the disk partition.
What name is given to analysis involving using the native operating system, on the evidence disk or a forensic duplicate, to peruse the data?
What version of RAID are the following descriptors? Striped disks with dual parity combine four or more disks in a way that protects data against loss of any two disks.
The is the continuity of control of evidence that makes it possible to account for all that has happened to evidence between its original collection and its appearance in court, preferably unaltered.
What was designed as an area where computer vendors could store data that is shielded from user activities and operating system utilities, such as delete and format?
Also Check Out: DNP 835 Topic 8 DQ 1 Describe the eight recommendations proposed in the IHI report that DNP leaders can apply to accelerate patient safety and the prevention of harm
is the concept that any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community.
ADDITIONAL INSTRUCTIONS FOR THE CLASS
Discussion Questions (DQ)
Initial responses to the DQ should address all components of the questions asked, include a minimum of one scholarly source, and be at least 250 words.
Successful responses are substantive (i.e., add something new to the discussion, engage others in the discussion, well-developed idea) and include at least one scholarly source.
One or two sentence responses, simple statements of agreement or “good post,” and responses that are off-topic will not count as substantive. Substantive responses should be at least 150 words.
I encourage you to incorporate the readings from the week (as applicable) into your responses.
Weekly Participation
Your initial responses to the mandatory DQ do not count toward participation and are graded separately.
In addition to the DQ responses, you must post at least one reply to peers (or me) on three separate days, for a total of three replies.
Participation posts do not require a scholarly source/citation (unless you cite someone else’s work).
Part of your weekly participation includes viewing the weekly announcement and attesting to watching it in the comments. These announcements are made to ensure you understand everything that is due during the week.
APA Format and Writing Quality
Familiarize yourself with APA format and practice using it correctly. It is used for most writing assignments for your degree. Visit the Writing Center in the Student Success Center, under the Resources tab in LoudCloud for APA paper templates, citation examples, tips, etc. Points will be deducted for poor use of APA format or absence of APA format (if required).
Cite all sources of information! When in doubt, cite the source. Paraphrasing also requires a citation.
I highly recommend using the APA Publication Manual, 6th edition.
Use of Direct Quotes
I discourage overutilization of direct quotes in DQs and assignments at the Masters’ level and deduct points accordingly.
As Masters’ level students, it is important that you be able to critically analyze and interpret information from journal articles and other resources. Simply restating someone else’s words does not demonstrate an understanding of the content or critical analysis of the content.
It is best to paraphrase content and cite your source.
LopesWrite Policy
For assignments that need to be submitted to LopesWrite, please be sure you have received your report and Similarity Index (SI) percentage BEFORE you do a “final submit” to me.
Once you have received your report, please review it. This report will show you grammatical, punctuation, and spelling errors that can easily be fixed. Take the extra few minutes to review instead of getting counted off for these mistakes.
Review your similarities. Did you forget to cite something? Did you not paraphrase well enough? Is your paper made up of someone else’s thoughts more than your own?
Visit the Writing Center in the Student Success Center, under the Resources tab in LoudCloud for tips on improving your paper and SI score.
Late Policy
The university’s policy on late assignments is 10% penalty PER DAY LATE. This also applies to late DQ replies.
Please communicate with me if you anticipate having to submit an assignment late. I am happy to be flexible, with advance notice. We may be able to work out an extension based on extenuating circumstances.
If you do not communicate with me before submitting an assignment late, the GCU late policy will be in effect.
I do not accept assignments that are two or more weeks late unless we have worked out an extension.
As per policy, no assignments are accepted after the last day of class. Any assignment submitted after midnight on the last day of class will not be accepted for grading.
Communication
Communication is so very important. There are multiple ways to communicate with me:
Questions to Instructor Forum: This is a great place to ask course content or assignment questions. If you have a question, there is a good chance one of your peers does as well. This is a public forum for the class.
Individual Forum: This is a private forum to ask me questions or send me messages. This will be checked at least once every 24 hours.