Questions:
1.Explain the importance of demonstrating that a forensic process was followed to a criminal or civil case. Address the impact on the case of using tools that are not vetted by the community.
2.You attempt to acquire a PC, but the data on the PC has been encrypted. What steps can you take to recover the password or data?
3.Discuss the importance of timestamping server and network log files that might be used as evidence to a court case.
4.What is the significance of the 4th Amendment to a forensic investigation? If you are a corporation, what is the best way to ensure that users waive any expectation of privacy when using their computers?
5.As a forensic investigator, provide two examples, one of a corporate investigation and one of a civil investigation, in which you would be asked to provide evidence. Where would the evidence supporting each of the cases in your example be likely to reside?
6.What are the "Federal Rules of Evidence"? Where did they originate? What impact on log file admissibility might they have?
7.Write blockers are used to protect against inadvertently tainting evidence. Provide a discussion of the different ways that these can be implemented and an example of a specific vendor technology.
8.What information of importance to an investigation can be recovered from performing a bit-by-bit forensic duplication of a hard drive that cannot be recovered by performing a standard copy of one drive to another? Discuss the three most popular formats for bit-stream images of digital media.
9.Discuss how a hashing algorithm is used in a forensic investigation to prove evidence integrity and discuss how using a tool shown to cause collisions could be detrimental to the case. Provide an example of an algorithm used to authenticate the data.
10.Explain the challenges to acquiring data from RAID disks.
11.When would a remote acquisition be preferred? What tool would you recommend, and why?
12.Describe 4 different ways that a criminal can hide data (think anti-forensics, too). How would you find each of these in your investigation?