Home > Articles

  • Print
  • + Share This
This chapter is from the book


Classroom Discussions

  1. Under what circumstances is a computer forensics investigator required to conduct an investigation onsite and not be able to remove a computer for analysis back at the lab?
  2. What are the major challenges associated with removable memory that investigators face?

Multiple-Choice Questions

  1. Which of the following facilitates the communication between a computer’s CPU and hard disks?

    1. Actuator arm
    2. ROM chip
    3. Disk controller
    4. FireWire
  2. Which of the following is true of a disk clone?

    1. It is a bootable copy.
    2. It can be used as a hard drive backup.
    3. Neither A nor B.
    4. Both A and B.
  3. Which of the following is true of solid state drives?

    1. They have no moving parts.
    2. Files are stored on metal platters.
    3. It is volatile memory.
    4. None of the above are true.
  4. Which of the following is volatile memory that is used for processes that are currently running on a computer?

    1. RAM
    2. ROM
    3. Hard disk drive
    4. Flash
  5. Which of the following refers to two or more disks used in conjunction with one another to provide increased performance and reliability through redundancy?

    1. RAM
    2. SCSI
    3. IDE
    4. RAID
  6. FireWire is based upon which of the following standards?

    1. 802.11
    2. ANSI N42
    3. IEEE 1394
    4. ISO 9660
  7. Which of the following memory cards is most likely to be found in Sony electronics?

    1. Secure Digital Card
    2. CompactFlash
    3. MultiMedia Card
    4. Memory Stick
  8. The reflective surfaces on a CD burned flat by a laser are referred to as which of the following?

    1. Lands
    2. Pits
    3. Mirrors
    4. Craters
  9. Which of the following is a high-capacity optical disc that can be used to store high-definition video?

    1. CD
    2. DVD
    3. BD
    4. VCD
  10. Which of the following is a UNIX command that produces a raw data image of a storage medium, like a hard drive or magnetic tape in a forensically sound manner?

    1. aa
    2. bb
    3. cc
    4. dd

Fill in the Blanks

  1. Boot ____ is a utility included with Mac OS X 10.6 (Snow Leopard) that enables to user to run Windows operating system on an Intel-based Mac.
  2. Integrated Drive ____ is a drive interface, connector, and controller, which is largely based on IBM PC standards, for devices like hard disk drives, tape drives, and optical drives.
  3. ____ ATA is an interface that connects devices, like hard disk drives to host bus adapters.
  4. A disk ____ is actually one file or a group of files that contain bit-for-bit copies of a hard drive but cannot be used for booting a computer or other operations.
  5. The Host ____ Area is a region on a hard disk will often contain code associated with the BIOS for booting and recovery purposes.
  6. ____ collection is a memory management process that removes unused files to make more memory available.
  7. Fault ____ means that if one component in a system, like a hard disk drive, fails then the system will continue to operate.
  8. A(n) ____ is a hardware device that allows an individual to read data from a device, like a hard drive, without writing to that device.
  9. The less reflective surfaces on a CD that have not been burned by a laser are called ____.
  10. A(n) ____ disk is a thin, flexible, plastic computer storage disc that is housed in a rigid plastic rectangular casing.


Work with a Dual-Boot System

Find an Apple Mac computer running a dual-boot system, or install Boot Camp and Microsoft Windows on an Apple Mac with Mac OS X currently running. Create standard operating procedures to help computer forensics investigators identify whether a Mac computer is running more than one operating system and determine how to acquire digital evidence from this type of machine.

Identify Changes in Computer Hardware

Write an essay that discusses how computer hardware and memory are likely to be transformed over the next 5 years. Include in your discussion how computer forensics practices will have to change to keep pace with changing technology.

Identify the Use of RAID

Find out how an investigator can identify whether a suspect’s computer is running RAID. How should RAID be forensically examined?

Work with Volatile Memory

Random Access Memory (RAM) can provide an extraordinary amount of evidence. What computer forensics tools can be used to image RAM? Are there any issues with using RAM as a source of evidence in an investigation?

Explain USB Flash Memory

Explain the physical makeup of a USB flash drive. Include in your research how files are stored and organized on this type of storage device.

  • + Share This
  • 🔖 Save To Your Account