Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?
During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?
What is the smallest physical storage unit on a hard drive?
Depending upon the jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?
Before performing a logical or physical search of a drive in Encase, what must be added to the program?
What is one method of bypassing a system BIOS password?
What is the default IIS log location?
When reviewing web logs, you see an entry for resource not found in the HTTP status code field.
What is the actual error code that you would see in the log for resource not found?
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
An executive has leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?
When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?
To check for POP3 traffic using Ethereal, what port should an investigator search by?
Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?
What file is processed at the end of a Windows XP boot to initialize the logon dialog box?
Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?
