Answers to Multiple-Choice and Fill in the Blanks Questions

Chapter 1 Answers


1. Which of the following best defines computer forensics?

Answer: B. Computer forensics is the use of digital evidence to solve a crime.

2. A Chain of Custody form is used to document which of the following?

Answer: C. Anyone who has been in contact with evidence in a case.

3. Which of the following can be of evidentiary value to a computer forensics examiner?

Answer: D. All of the above.

4. Which of the following statements best describes a bit-stream imaging tool?

Answer: D. Both A and B are correct.

5. Which of the following are benefits of e-mail evidence?

Answer: D. All of the above.

6. Which of the following statements is not true about photo ...

Get A Practical Guide to Computer Forensics Investigations now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.