JNTU
JNTU B.Tech IV COMPUTER FORENSICS Previous Question Paper (November/December- 2018 - R15)
Note: This question paper contains two parts A and B. Part A is compulsory which carries 25 marks. Answer all questions in Part A. Part B consists of 5 Units. Answer any one full question from each unit. Each question carries 10 marks and may have a, b, c as sub questions.
Part A
25 Marks
How are workstations selected for police, private and corporate computer forensics lab?
Answer
Workstations are selected based on the specific requirements of the investigation environment. Police labs prioritize high-performance, secure, and standardized hardware for chain-of-custody compliance. Corporate and private labs focus on scalability, cost-effectiveness, and compatibility with specific proprietary software used for internal audits or civil litigation.
What is the most significant legal issue in computer forensics? Explain.
Answer
The most significant legal issue is the admissibility of evidence. Evidence must be collected and handled in a manner that maintains its integrity and authenticity, ensuring it meets legal standards such as the Daubert or Frye tests to be accepted in court without being challenged as tampered or unreliable.
Who is responsible for securing the computer incident or crime scene?
Answer
Sign in to view the complete answer paper.
What is the first consideration when responding to a scene of crime? Explain.
Answer
Sign in to view the complete answer paper.
Enumerate the general steps for live acquisition.
Answer
Sign in to view the complete answer paper.
As a good forensic practice, why would it be a good idea to wipe a forensic drive before reusing it?
Answer
Sign in to view the complete answer paper.
Describe some computer forensics hardware tools.
Answer
Sign in to view the complete answer paper.
Explain the role or client and server in email. List and explain the tools for e-mail forensics.
Answer
Sign in to view the complete answer paper.
What are the steps executed when a NTFS computer is switched on? Explain.
Answer
Sign in to view the complete answer paper.
What are the system files of windows XP? Explain.
Answer
Sign in to view the complete answer paper.
Part B
50 Marks
What is disaster recovery plan? Why is it necessary for a computer forensics lab to have a disaster recovery plan?
Answer
Sign in to view the complete answer paper.
Explain the legal process to conduct computer investigation for potential criminal violations of law.
Answer
Sign in to view the complete answer paper.
State and explain any six rules of evidence. How evidence is collected in private sector incidents? Explain.
Answer
Sign in to view the complete answer paper.
State and explain the general tasks that the investigators perform when working with digital evidence.
Answer
Sign in to view the complete answer paper.
State and explain different data hiding techniques. How can partitions be hidden? Explain.
Answer
Sign in to view the complete answer paper.
Discuss the validation and discrimination issues when dealing with computer evidence.
Answer
Sign in to view the complete answer paper.
Explain the role of email in forensic investigations. List and explain the tasks in investigating e-mail crimes and violations.
Answer
Sign in to view the complete answer paper.
What criteria must be met so that when new software and hardware become available, testing standards are in place for the lab? Explain in detail with suitable examples.
Answer
Sign in to view the complete answer paper.
What is windows registry? Explain the following terms of windows registry: Registry editor, HKEY, Key, Subkey, branch, value, default value, hives.
Answer
Sign in to view the complete answer paper.
Explain the NTFS encrypting file system in details. Also, explain the EFS recovery agent with an example.
Answer
Sign in to view the complete answer paper.