During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

In the context of file deletion process, which of the following statement holds true?

In a FAT32 system, a 123 KB file will use how many sectors?

Which of the following should a computer forensics lab used for investigations have?

If you discover a criminal act while investigating a corporate policy abuse, it becomes a public- sector investigation and should be referred to law enforcement?

Which of the following is NOT a graphics file?

You should make at least how many bit-stream copies of a suspect drive?

Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called?

What will the following command produce on a website login page?What will the following command produce on a website? login page?

SELECT email, passwd, login_id, full_name

FROM members

WHERE email = ' someone@somehwere.com ' ; DROP TABLE members; -- '