Law and Politics

Replies / Views	Last post
The NTFS file system holds a substantial amount of metadata in the $MFT file. Which of the following ... Started by jessicacav	3 Replies 39 Views	May 5, 2019 by leahm14
Which of the following file attributes is unique to the NTFS file system? Started by Zoey63294	1 Replies 33 Views	May 5, 2019 by kthug
You are examining a Microsoft Word document and have used an application that reads the metadata of ... Started by corkyiscool3328	3 Replies 44 Views	May 5, 2019 by lolol
Which of the following is a valid example of a file identifier in the header of a file? Started by clippers!	1 Replies 36 Views	May 5, 2019 by Viet Thy
Which of the following are examples of system metadata? Started by casperchen82	3 Replies 22 Views	May 5, 2019 by covalentbond
A person is trying to hide her tracks after doing some things she shouldn't have on a computer ... Started by misspop	1 Replies 18 Views	May 5, 2019 by milbourne11
A DoD approved disk wiping utility works by instructing the hard disk controller to apply a strong ... Started by nummyann	3 Replies 189 Views	May 5, 2019 by ebe
The contents of memory on a running system will change for no apparent reason while the system is ... Started by aabwk4	1 Replies 32 Views	May 5, 2019 by joechoochoy
Why is it that most conventional applications are incapable of copying live memory from a computer system? Started by armygirl	3 Replies 61 Views	May 5, 2019 by yasmina
Regardless of the tool you choose to capture memory, you will always have to contend with the fact ... Started by Deast7027	1 Replies 29 Views	May 5, 2019 by cdmart10
The Expert Witness Format was originally developed as a proprietary format by a company specializing ... Started by Sportsfan2111	3 Replies 48 Views	May 5, 2019 by sokh
On a Windows XP machine, memory is treated as a physical device. The internal address for memory in ... Started by casperchen82	1 Replies 60 Views	May 5, 2019 by lcapri7
You are one of the first to arrive on a scene and you are asked to perform live memory capture on a ... Started by Jramos095	3 Replies 31 Views	May 5, 2019 by macagnavarro
Which Linux utility is often used to make forensic disk images? Started by pane00	1 Replies 77 Views	May 5, 2019 by bookworm410
Which two of the following items can be captured from live memory, but lost when the system is shut down? Started by AEWBW	3 Replies 81 Views	May 5, 2019 by Dunkey
Arriving on the scene of a potential crime, you are asked to examine a computer. Before taking it ... Started by joe	1 Replies 28 Views	May 5, 2019 by Expo
When capturing live memory from a computer system what is meant by the term footprint? Started by awywial	3 Replies 99 Views	May 5, 2019 by wuly
Which of the following command-line utilities is capable of making a forensic image of a hard disk, ... Started by pane00	1 Replies 53 Views	May 5, 2019 by connor417
In order to make a forensically sound copy of a hard disk for analysis, it is critical that you ... Started by tnt_battle	3 Replies 147 Views	May 5, 2019 by Kingjoffery
Aside from a live memory capture taken at the time of first response, what are two locations on a ... Started by gonzo233	1 Replies 26 Views	May 5, 2019 by vboyd24
Place the item on the right in the correct position in regards to the order of volatility. Started by mpobi80	3 Replies 31 Views	May 5, 2019 by Athena23
After the conclusion of any criminal trial, if it becomes evident that an appeal is not possible, ... Started by corkyiscool3328	3 Replies 24 Views	May 5, 2019 by mrphibs
You arrive on the scene of an investigation. The computer sitting on the suspect's desk is turned ... Started by bclement10	1 Replies 43 Views	May 5, 2019 by maaaaaaaaaa
You are working on a criminal case in which a spreadsheet found on the computer system indicates ... Started by jparksx	3 Replies 18 Views	May 5, 2019 by jennafosdick
Wiles and Reyes identified four critical characteristics that an evidence storage facility must ... Started by charchew	3 Replies 30 Views	May 5, 2019 by vkodali