CJ386-Unit 7 Review• A questioned document is any material that contains marks,

symbols or signs conveying a meaning or message and whose source or authenticity is in question.

• Questioned documents are not restricted to pieces of paper bearing handwritten text, but also include computer printing, typewritten material, and markings such as graffiti on walls, and other surfaces.

• The single most common activity of the forensic document examiner is the identification of handwriting.

• High quality known samples of handwriting (exemplars) are required for handwriting comparisons

• .• Document examiners also compare typewritings, photocopier

copies, and computer printed documents.

• Document examiners are also called upon to compare samples of ink and paper.

Unit 8 Seminar-Chapter 19 Questions

• What is computer forensics?

• Name some crimes that involve the use of a computer.

• What is the difference between computer hardware and computer software?

• What is the main circuit board of a computer called?

Unit 8 Seminar- Chapter 19 Questions

• What part of a computer, found on the ‘Mother Board’ contains a complex of wires, which serves to carry data from one hardware device to another?

• What part of a computer is referred to as the ‘brain’ of the computer?

• Is the operating system in a computer considered to be hardware or software?

Unit 8 Seminar-chapter 19 Questions

• What does the term ‘bit’ stand for?

• What is the first thing a crime scene investigator should do when encountering computer forensic evidence?

• What are the two ways that a computer crime scene must be documented?

 

Unit 6 chapter 15 Questions

• What is the difference between visible data and latent data?

• What is an IP address and what potential value does it have in computer forensics investigations?

• What is the unauthorized intrusion into a computer called?

Unit 8-Computer Forensics Review

• The first thing a computer investigator must do is obtain a search warrant

• Images of a hard disk drive must be captured without altering the drive in any way

• Latent data is hidden from view• The word processing or text-based document files are a

common place to look for evidential data• A ‘fingerprint’ must be made of the hard disk drive both

before and after imaging its contents• Cookies, internet history and cache are all potential

sources of evidence on a computer