Essay Questions
Total of 100 points. You may need to briefly research some of these, otherwise, lean heavily on your course readings. UMUC grading policies apply so cite your sources, otherwise there will be a 20% markdown per question. You do not have to cite sources for the multiple choice questions. Note that any copied answers from Internet sources will receive 0 points.
Session 7 (20 points). Discuss some of the forensic evidence that might be retrieved from a Windows OS, including that that might be found in the registry, MBR, raw memory, and the page file.
Session 7 (10 points). Discuss why command line tools may be a better solution that a graphical tool when working with Windows.
Session 8. (10 points). Address why it is important that a disk that will be used to acquire an image is forensically wiped prior to capturing the evidence?
Session 8 and 9 (20 points). Apply the 5 questions used to determine repeatability in Session 8s notes to a tool that you can find that you would use in a Linux or Macintosh investigation.
Session 10 (10 points). Discuss some of the content found within an email header that can be useful in an investigation. Name one tool that could be used in an email investigation, and describe the information it retrieves.
Session 10 (10 points). Discuss at least 3 challenges associated with performing a forensic investigation on a mobile device. Discuss a tool that would be used in a forensic investigation on a mobile device.
Session 10 (20 point question). Read the following scenario and respond to the questions below:
As a digital forensics examiner, you have been called to the scene of a kidnapping. Several witnesses have told the investigator that the victim was very excited about a new person they met online. Your job at the scene as a digital forensics examiner (ensure you ONLY address digital forensics you are not a forensic investigator of any other type) is to recommend to the investigating officer a course of action as to what digital evidence may or may not be needed to investigate this crime.
Provide a list of potential digital evidence that the investigator is going to want to seize for possible forensic examination. Be thorough, as the lead investigator in this case is not computer savvy.
What additional sources of evidence might there be besides the digital equipment and media that would have been seized? How would you gain access to this evidence?
Use the order calculator below and get started! Contact our live support team for any assistance or inquiry.
[order_calculator]