NPA Cyber Security: Digital Forensics Levels 4-6

<p>To preserve evidence in its original form (B)</p> Signup and view all the answers

<p>Electronic data from digital devices (C)</p> Signup and view all the answers

<p>It has necessitated the use of Digital Forensics in investigations. (C)</p> Signup and view all the answers

<p>Recovering and interpreting electronic data (C)</p> Signup and view all the answers

<p>Any private citizen or organization (C)</p> Signup and view all the answers

<p>The seriousness of the charges (B)</p> Signup and view all the answers

<p>The Depute Procurator Fiscal or Procurator Fiscal (B)</p> Signup and view all the answers

<p>Insufficient evidence (D)</p> Signup and view all the answers

<p>To explain their examination in straightforward language (C)</p> Signup and view all the answers

<p>The Crown versus ... (B)</p> Signup and view all the answers

<p>Clear, unambiguous, and unbiased (B)</p> Signup and view all the answers

<p>Office of the Lord Advocate (C)</p> Signup and view all the answers

<p>Disclosure (D)</p> Signup and view all the answers

<p>pcap file (A)</p> Signup and view all the answers

<p>Locations of calls made (C)</p> Signup and view all the answers

<p>TOR (B)</p> Signup and view all the answers

<p>It requires advanced techniques to access data. (A)</p> Signup and view all the answers

<p>Location data (A)</p> Signup and view all the answers

<p>They conceal both sender and receiver. (B)</p> Signup and view all the answers

<p>Application usage (B)</p> Signup and view all the answers

<p>Powerful processing requirements (C)</p> Signup and view all the answers

<p>To prevent any alterations to the original data (C)</p> Signup and view all the answers

<p>The examiner should document the alterations (D)</p> Signup and view all the answers

<p>Both should be exactly the same at all times. (B)</p> Signup and view all the answers

<p>Ensuring the original data cannot be altered during the process (B)</p> Signup and view all the answers

<p>To the Write Blocker first, then to another storage device (A)</p> Signup and view all the answers

<p>The prime copy (D)</p> Signup and view all the answers

<p>It should be stored securely in a fireproof safe. (A)</p> Signup and view all the answers

<p>FTK Imager (A)</p> Signup and view all the answers

<p>To create a unique identifier for data copies (B)</p> Signup and view all the answers

<p>SHA 256 (D)</p> Signup and view all the answers

<p>To maintain the original data's integrity (D)</p> Signup and view all the answers

<p>If the copy matches the original (B)</p> Signup and view all the answers

<p>Hash Codes (D)</p> Signup and view all the answers

<p>The evidence may be considered worthless in court (B)</p> Signup and view all the answers

<p>Through the application of hashing techniques (C)</p> Signup and view all the answers

<p>Best Evidence (D)</p> Signup and view all the answers

<p>To gather evidence and report facts neutrally. (A)</p> Signup and view all the answers

<p>A detailed timeline of evidence. (B)</p> Signup and view all the answers

<p>The Procurator Fiscal. (A)</p> Signup and view all the answers

<p>It helps establish the authenticity and reliability of the evidence. (A)</p> Signup and view all the answers

<p>Report it to the lead investigator for further consideration. (B)</p> Signup and view all the answers

<p>To explain technical findings in an understandable manner. (C)</p> Signup and view all the answers

<p>The evidence may be deemed inadmissible in court. (C)</p> Signup and view all the answers

<p>The sequence of events related to the suspect and potential evidence. (D)</p> Signup and view all the answers

Applying computer scientific tests and techniques to solve a crime, involving recovering and interpreting electronic data while preserving evidence in its original form.

An event that might trigger an investigation into a suspected crime.

Systematic process to collect, identify, and validate digital data to recreate past events.

A crime for which there's a reasonable cause to believe it occurred.

A government organization responsible for upholding the law.

Maintaining digital data in its original state to avoid altering any information.

The process of reporting a suspected crime event.

Electronic devices like smartphones, computers, and tablets used to store data.

Information about network activity, typically stored in pcap files, collected by network analysis software.

Detailed call history, location data, and timestamps from mobile devices maintained by phone service providers.

Previously deleted files on mobile devices that can be retrieved and looked at by investigators.

Records of a phone's location and times when it was turned on, even if not used for calls.

Data protected by encryption on modern devices (smartphones, tablets, laptops), potentially making examination harder.

An online network that hides user identities and makes tracing communications difficult for investigators.

A network that conceals sender and receiver identities and encrypts communications, making them challenging to decrypt and trace.

A Digital Forensic Examiner interprets technical information and explains it in court, remaining neutral and gathering evidence, not proving guilt or innocence.

A chronological record of digital activity reconstructed by the examiner to help determine a suspect's actions.

The Digital Forensic Examiner's report, along with the lead investigator's report, is submitted to the Procurator Fiscal in Scotland.

The Procurator Fiscal, in Scotland, reviews the evidence and decides if there's enough to proceed to a trial.

The documented and unbroken trail of evidence, showing its origin, handling, and storage, ensuring its integrity.

Digital forensic evidence should be interpreted without bias, showing what happened, not drawing conclusions about guilt.

If evidence points to someone's innocence, the lead investigator should consider it and possibly re-evaluate the investigation.

If evidence suggests innocence, the lead investigator should consider whether the real perpetrator is still at large.

A secure, tamper-proof copy of digital evidence kept for reference, typically stored in a locked safe.

A copy of digital evidence used for examination and analysis, allowing the original to remain untouched.

A device that prevents any new data from being written to a storage device while making a copy, ensuring a perfect replica.

A perfect copy of every single bit of data on a storage device, ensuring no information is lost or altered.

Write Blockers are used to prevent alteration of evidence by stopping any new data from being written to the original storage device while making a copy.

Having a prime copy (the original) and a working copy (for analysis) ensures that the original evidence remains untouched and unaltered throughout the investigation.

A software application used to create exact images of the contents of a storage medium when the device cannot be easily removed.

Documenting all changes to the working copy ensures the integrity of the evidence and allows for a clear audit trail of any actions taken on the data.

A method used to generate a unique 'fingerprint' (Hash Code) for digital data, ensuring that any copy can be verified as identical to the original.

A long string of letters and digits produced by applying a mathematical process (Hashing) to data. It uniquely identifies the data and verifies its integrity.

Common hashing techniques used in digital forensics to verify the integrity of data copies. MD5 (Message Digest 5) and SHA1 (Secure Hashing Algorithm 1) are often used together for double-checking.

In legal cases, this refers to the original or most reliable source of evidence. In digital forensics, verified copies of data obtained through hashing are considered 'Best Evidence'.

It ensures that any investigation findings based on the copy are admissible in court. If the copy is not identical to the original, the evidence might be considered unreliable.

It means the copy is not an exact replica of the original data. This could indicate tampering, corruption, or accidental changes. The copy cannot be used as evidence.

A website that allows you to see Hashing Codes being created. It provides a tool for understanding how hashing works and generating hash codes for different data.

To ensure the admissibility of digital evidence in court by verifying that copies of data are identical to the originals, preserving the integrity of the evidence.

A Scottish legal professional who investigates and prosecutes crimes in Sheriff Court, representing 'The Crown'.

The court in Scotland where the most serious crimes are tried, cases reaching it are handled by the Office of the Lord Advocate.

The term used in Scotland to refer to the prosecution side in a criminal trial, represented by Procurator Fiscal or Lord Advocate.

A reason why the Procurator Fiscal may decide not to prosecute a crime, even if there is enough evidence, if they believe it wouldn't benefit society.

A principle in Scots Law where both the prosecution (Crown) and defense have to share evidence with each other before a trial.

The Digital Forensic Examiner may be called to court to explain their findings. They must present their evidence using clear and unbiased language.

The examiner must explain the how they conducted their investigation using clear, unambiguous, and unbiased language, ready for questioning.

Both the defense and Crown lawyers can question the Digital Forensic Examiner's findings and testimony.