Cnit 420 Midterm |146 Questions| With Correct Answers.

What must every piece of evidence need? {Ans: its own report, ID number and container}Where is the partition table located? {Ans: master boot record (mbr)}Public sector digital investigations {Ans: government agencies, funded by tax dollars, and subject to the US Criminal and Constitutional Law}What is innocent information? {Ans: unrelated information to the investigation}What does an OS assign to sectors (a single area on a disk)? {Ans: a physical address}What is digital evidence {Ans: any information stored or transmitted in digital form}How is the best acquisition method determined? {Ans: circumstance of the investigation}What does mkfs.msdos do? {Ans: formats FAT file system from Linux}Where does a computer's system config and date/time get stored? {Ans: CMOS}What are 3 advantages of windows acquisition tools? {Ans: must use a write blocker, data can't be obtained from disk's host protected area, some countries haven't accepted use of write blockers}