- (Topic 3)
When cataloging digital evidence, the primary goal is to

1. A. Make bit-stream images of all hard drives
2. B. Preserve evidence integrity
3. C. Not remove the evidence from the scene
4. D. Not allow the computer to be turned off

Correct Answer: B

- (Topic 2)
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:RECYCLED using a command line tool but does not find anything. What is the reason for this?

1. A. He should search in C:\Windows\System32\RECYCLED folder
2. B. The Recycle Bin does not exist on the hard drive
3. C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
4. D. Only FAT system contains RECYCLED folder and not NTFS

Correct Answer: C

- (Topic 1)
Subscriber Identity Module (SIM) is a removable component that contains essential information about the subscriber. Its main function entails authenticating the user of the cell
phone to the network to gain access to subscribed services. SIM contains a 20-digit long Integrated Circuit Card identification (ICCID) number, identify the issuer identifier Number from the ICCID below.

1. A. 89
2. B. 44
3. C. 245252
4. D. 001451548

Correct Answer: C

- (Topic 3)
If you plan to startup a suspect’s computer, you must modify the ____ to ensure that you do not contaminate or alter data on the suspect’s hard drive by booting to the hard drive.

1. A. deltree command
2. B. CMOS
3. C. Boot.sys
4. D. Scandisk utility
5. E. boot.ini

Correct Answer: E
The OS isn’t specified, but if this was a Windows OS, then this would be boot.ini
The answer is CMOS. The startup of a computer is the boot sequence, and the boot sequence is defined in the CMOS. The common occurrence is to boot off a floppy, and you need to see that the floppy (usually the A drive) is first in the sequence. If you don’t, and the hard drive is first, then booting the system wil boot the hard drive and alter the evidence.

- (Topic 1)
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:

1. A. C:\windows\system32\config\SAM
2. B. C:\windows\system32\con\SAM
3. C. C:\windows\system32\Boot\SAM
4. D. C:\windows\system32\drivers\SAM

Correct Answer: A