Name : ..................................................

Student ID : .................................................

COMPUTER FORENSICS
QUIZ

1. Sabotage of data and/or networks does not come under cyber crime.
True False

2. A cyber crime involving a breach of trust from employees within an organization is called an insider attack.
True False

3. Sending threatening e-mail is a computer crime under the category computer as

an instrumentality.
True False

4. A computer forensics expert needs to be qualified only in the technical field.

True False

5. Obtaining a copy of evidence in a disk drive is not a part of the life cycle of a
computer forensic investigation.
True False

6. Cross-validation of findings is a good process in computer forensic investigation.

True False

7. 8. A computer forensics investigator can investigate on original evidence before

duplicating it.
True False

8. A computer forensics investigator should ensure that he has appropriate power

and authority to search and seizure before going for an investigation.
True False

9. Deleted digital evidence can be recovered from a computer disk.

True False

10. After imaging the original drive is moved to secure storage to prevent tampering.
True False

11. The chances of recovery does not depend on how full your computers hard drive.
True False

12. One of the cardinal rules of data recovery is that you must not stop using the disk
that contains the files you want to recover.
True False

13. If there is more than one drive in a computer, it will have a Recycled folder
for each drive.
True False

14. Computer expert witness should be a professional opinion on what that evidence
means and also be able to explain their findings in a clear manner.
True False

15. Presentation of digital evidence should be clear and highly technical format
when submitting to the court.
True False