Once a file is deleted by a user, it: A) Is obliterated from the system and cannot be recovered. B) Is retained until the disk space it occupies is allocated for another use. C) May be identified using forensic image acquisition software. D) Both B and C 12) Evidentiary data may be recovered from which of the following? A) Slack space on the HDD B) Unallocated space on the HDD C) RAM swap files D) All of the above 13) One gigabyte can be expressed as: A) 1,000 bytes. B) 1,000 megabytes (MB). C) 1,000 kilobytes (KB). D) 8,000 bits. 14) A software algorithm used to create a “fingerprint” of a file or an entire HDD is called: A) MD5. B) ROM. C) RAM. D) MAC OS. 15) Which of the following is NOT associated with the partitioning of a HDD? A) Quadrant B) Sector C) Track D) Cluster 16) A cluster is a group of ________ in multiples of ________. A) Partitions, two B) Disks, four C) Cylinders, three D) Sectors, two 17) What keeps track of the location of files and folders on the HDD? A) The search engine B) The HDD itself C) The CPU D) The FAT 18) When is it necessary to make a “fingerprint” of a HDD? A) In most cases B) Only sometimes C) Before and after imaging its contents D) Rarely 19) Which of the following is NOT classified as software? A) Operating systems B) Word processors C) Web browsers D) Flash drives 20) The boot (start-up) process for a computer is controlled by: A) The hard disk drive. B) ROM. C) RAM. D) USB thumb drives.
> Two types of empirical tests are color tests and ________ tests. 12) ________ can separate unknown mixtures into their components. 13) ________ drugs are substances that are chemically related to some controlled drugs and are pharmacologically potent.
> A ________ may be defined as a natural or synthetic substance that is used to produce physiological or psychological effects in humans or other animals. 2) ________ dependence is the conditioned use of a drug caused by underlying emotional needs. 3) Th
> The three basic cuticle patterns are coronal, spinous, and ________. 12) The ________ is the main body of the hair shaft. 13) Collecting ________ full-length hairs from all areas of the scalp normally ensures a representative sampling. 14) Fibers are
> Hair is an appendage of the skin that grows out of an organ known as the hair ________. 2) One feature that makes hair a good subject for establishing individual identity is its resistance to chemical ________. 3) The scale pattern of the cuticle is an
> The smallest unit of a(n) ________ is an atom. 22) ________ is a physical change from the solid state directly into the gaseous state. 23) The color of an opaque object is determined by which component color(s) of light it ________. 24) The three stat
> ________ solids have only one refractive index. 12) A(n) ________ property is a property that is not dependent on the size of an object. 13) The ________ line is a bright halo observed near the border of a particle that is immersed in a liquid with a d
> Shortly after a weapon is fired, residues are most likely to be deposited on the thumb web and the back of the firing hand of a shooter. A) True B) False 12) The SEM approach for primer residue detection is its enhanced specificity over hand swabbing. A
> Caliber is a measure of the diameter of the bore of a rifled firearm. A) True B) False 2) The hook cutter rifling method is still used today. A) True B) False 3) The number of lands and grooves and the width and direction of twist are individual charac
> Pollen and spores can be used to provide links between a crime scene and a person or object. A) True B) False 22) The pollen of entomophilous plants is dispersed by wind. A) True B) False 23) It is not possible to identify a geographical origin by the
> The basic metric unit for volume is the: A) Centimeter. B) Liter. C) Milliliter. D) Gram. 2) The weight 264.45 grams can be correctly expressed as: A) 26,445 decigrams. B) 0.26445 kilograms. C) 26.445 centigrams. D) None of the above 3) One millil
> The stereoscopic microscope has a narrow field of view. A) True B) False 12) An IR spectrum is unique for every chemical substance. A) True B) False 13) The SEM produces an image that is stereoscopic in appearance. A) True B) False 14) Many crystals a
> The magnification power of a microscope equals the magnifying power of the objective lens multiplied by two. A) True B) False 2) The microscopic examination of a bullet requires reflected light. A) True B) False 3) The body tube is part of the optical
> Some tools, such as Cellebrite’s UFED Touch, are quite clear about which devices support physical extraction. A) True B) False 22) You can’t use a 1G phone to track a 15-year-old crime. A) True B) False 23) When a mobile device is set to use WiFi, it w
> SD cards and SIM cards perform the same way. A) True B) False 12) Each SIM card has an international mobile subscriber identity number that associates the phone with the subscriber’s mobile network. A) True B) False 13) All mobile devices use SIM cards
> Mobile devices began as an outgrowth of ship-to-shore radios in World War I. A) True B) False 2) 2G appeared in the 1990s using two standards: GSM & CDMA. A) True B) False 3) Analog phones have divergent feature sets. The core features usually were pho
> MMS, or Multimedia Message Service, is text messaging with attachments. A) True B) False 22) The call history for a mobile device is generally not able to be used in an investigation. A) True B) False 23) Often mobile devices contain the same Internet
> The primary goal in obtaining data from a HDD is to do so without altering even one bit of data. A) True B) False 12) Visible data exists in areas of the drive that are, generally speaking, unknown and inaccessible to most end users. A) True B) False 1
> Software comprises the physical components of the computer. A) True B) False 2) The central processing unit is the main system board of a computer that delivers power, data, and instructions to the computer’s components. A) True B) False 3) The centra
> Two analytical techniques used to analyze writing inks are microspectrophotometry and thin-layer chromatography. A) True B) False 12) The most common features associated with a paper examination are general appearance, color, weight, and watermarks. A)
> Angularity, slope, and speed are examples of individual variations. A) True B) False 2) Margins, spacing, crowding, insertions, alignment, spelling, punctuation, phraseology, and grammar cannot impart individual variations. A) True B) False 3) An adequ
> A technique applicable for determining whether or not an individual has recently fired a weapon is: A) Neutron activation analysis. B) Atomic absorption analysis. C) The scanning electron microscope. D) All of the above 32) Objects bearing tool marks sh
> Black powder does not explode when unconfined. A) True B) False 32) Nitroglycerin-based dynamite has virtually disappeared from the industrial explosives market. A) True B) False 33) Military “dynamite” contains no nitroglycerin. A) True B) False
> Detonation is characterized by very rapid oxidation that produces heat, light, and a subsonic pressure wave. A) True B) False 22) Low explosives detonate relatively slowly (less than 1,000 meters per second), while high explosives detonate very rapidly
> A search of the fire scene must focus on finding the fire’s point of origin. A) True B) False 12) Water does not interfere with laboratory methods used to detect and characterize flammable liquid residues. A) True B) False 13) Wood is a poor insulator.
> The quantity of heat from a chemical reaction comes from the presence of oxygen in the reaction. A) True B) False 2) Molecules must absorb energy when their bonds are reformed and they liberate energy when their bonds break apart. A) True B) False 3) R
> STR analysis is the most successful and widely used DNA profiling procedure. A) True B) False 12) The more STRs a forensic scientist can characterize, the greater is the likelihood that they originated from two different individuals. A) True B) False
> James Watson and Francis Crick are credited with discovering the structure of DNA. A) True B) False 2) The four bases on the DNA molecule are paired with A opposite T and G opposite C. A) True B) False 3) Longer DNA strands are more stable and less sub
> A heterozygous gene pair is made up of two different alleles while a homozygous gene pair is made up of two similar alleles. A) True B) False 12) When two different genes are inherited, the characteristic coded for by a recessive gene is expressed. A) T
> The blood factors belonging to the A-B-O system are the most important for properly matching a donor and recipient for a transfusion. A) True B) False 2) People with type O blood have both A and B antigens on their red blood cells. A) True B) False 3)
> The minerals found in different soil samples cannot effectively be used to determine whether or not they have the same origin. A) True B) False 22) Standard/reference soil samples should be collected at the site of the crime at various intervals within
> Gamma rays are a high-energy form of electromagnetic radiation. A) True B) False 12) The major advantage of neutron activation analysis is that it provides a nondestructive method for identifying and quantitating trace elements. A) True B) False 13) Ne
> Which of the following is NOT expected to show any evidential marks or impressions? A) A fired bullet B) A cartridge casing fired from a handgun C) A cartridge casing fired from a shotgun D) A shotgun pellet 22) What are two elements detected on the han
> The presence of trace elements is useful because they provide markers that may establish the source of a material. A) True B) False 2) A continuous spectrum is most helpful in identifying a particular element because it serves as a unique “fingerprint”
> An alcoholic disinfectant should be applied to a subject’s skin before drawing blood. A) True B) False 12) An airtight container best ensures the preservation of blood samples. A) True B) False 13) An anticoagulant should be added to inhibit the growth
> Alcohol is the most widely abused drug in Western countries. A) True B) False 2) Alcohol tends to be distributed throughout the watery parts of the body. A) True B) False 3) The quantity and type of food present in the stomach at the time of drinking d
> Many chemical substances have similar mass spectra fragmentation. A) True B) False 22) Gas chromatography cannot produce a specific identification of a chemical substance. A) True B) False 23) A mass spectrometer can detect materials weighing only one
> Hashish is a concentrated resin secreted by the Cannabis plant. A) True B) False 12) Marijuana is synthesized from the Cannabis sativa plant. A) True B) False 13) Drugs deemed to have the highest potential for abuse and having a current medical use are
> Increasing caseloads associated with drug evidence have provided the major justification for expanding forensic laboratory services. A) True B) False 2) A drug user’s expectations do not play a role in drug dependence. A) True B) False 3) Psychologica
> It is not necessary for questioned and standard/reference hairs to come from the same area of the body. A) True B) False 12) The entire hair is collected because a hair may show variation in color and other morphological features over its entire length.
> Much of a hair’s resistance and stability is attributed to the cuticle. A) True B) False 2) The scale pattern of the cortex is an important feature for characterizing animal hair. A) True B) False 3) The cortex derives its major forensic importance fr
> The only way to individualize glass fragments at a crime scene to a single source is to assemble the fragments and physically fit them together like a jigsaw puzzle. A) True B) False 22) Glass fragments removed from a single sheet of plate glass have a
> The weight of an object can vary from one location to another while mass remains the same regardless of location. A) True B) False 12) The atoms in a crystalline solid have a regular arrangement while the atoms in an amorphous solid have no regular orde
> The likelihood of detecting gunshot residue on swabs taken from living subjects more than six hours after a firing has occurred is ________ the likelihood of detecting gunshot residue within two hours of a firing. A) The same as B) Less than C) Greater t
> The basic metric unit of volume is the ounce. A) True B) False 2) Water boils at 100 degrees Celsius. A) True B) False 3) The boiling point of a substance is a physical property. A) True B) False 4) The two most important physical properties of glass
> It may not be possible to recover deleted file items from a mobile device, such as: A) E-mails. B) Text messages. C) Photos. D) All the above 12) How many types of chains of evidence are there? A) 1 B) 2 C) 4 D) 5 13) When working on electronic device
> 1) What does 1G consist of? A) Analog networks B) Digital networks C) Broadband networks D) Native IP networks 2) What does 2G consist of? A) Analog networks B) Digital networks C) Broadband networks D) Native IP networks 3) What does 3G consist of? A
> A device that permits only requested traffic to enter a computer system is known as a(n): A) Central processing unit (CPU). B) Firewall. C) Cookie. D) Internet cache. 42) Which type of data are readily available to a computer user? A) Swap B) Latent C)
> Files containing chat and instant messaging are most likely stored in: A) Swap files. B) RAM. C) ROM. D) Slack files. 32) Which of the following carries data from one hardware device to another? A) System bus B) Central processing unit (CPU) C) Random-a
> The complex of wires located on the motherboard which serves to carry data from one hardware device to another is: A) RAM. B) ROM. C) System bus. D) Central processing unit. 22) Sectors are typically how many bytes in size? A) 126 bytes B) 256 bytes C)
> Which of the following is NOT considered a hardware device? A) Monitor B) Hard disk drive C) Mouse D) Operating system 2) Which of the following is NOT considered a type of software? A) Linux B) Firefox C) Excel D) Random Access Memory 3) A m
> When comparing sample writing to a suspect document, the age difference between the documents should be no more than: A) Six to twelve months. B) Twelve to eighteen months. C) Two to three years. D) Five to seven years. 22) Which are important character
> When dictating to a person in order to obtain samples of handwriting, one should NOT: A) Use paper similar to that of the questioned document. B) Use a pen similar to that of the questioned document. C) Dictate the contents of the text at least three tim
> The barrel of a shotgun: A) Is indistinguishable from that of a rifle. B) Is smooth without the grooves and lands found in rifles. C) Is generally shorter than that of a rifle. D) Is wider at the end to concentrate the shot. 2) The reason grooves are ri
> 1) Questioned documents include: A) Contracts and passports. B) Petitions and lottery tickets. C) Letters and checks. D) All of the above 2) The possibility of recognizing known writing habits in samples produced when a writer is under the influence
> Many explosives must have their own source of: A) Fuel. B) Oxygen. C) Heat. D) Energy. 52) A low explosive has a velocity of detonation less than: A) 150 meters per second. B) 500 meters per second. C) 1000 meters per second. D) 1500 meters per second.
> Which is a device used to screen objects for the presence of explosive residues? A) X-ray diffraction B) Mass spectrometry C) Infrared spectrophotometry D) Ion mobility spectrometry 42) A procedure commonly used as a screening test for explosive residue
> The transfer of heat energy by the movement of molecules within a liquid or gas is: A) Radiation. B) Oxidation. C) Convection. D) Conduction. 32) What is the major advantage of using the vapor concentration technique with gas chromatography? A) Low reso
> The quantity of heat from a chemical reaction comes from: A) The breaking and formation of chemical bonds. B) The presence of oxygen in the reaction. C) The emission of radiation. D) The composition of the fuel-air mix. 22) Complex chromatographic accel
> Which instrumentation is considered the most sensitive and reliable for detecting and characterizing flammable residues? A) NAA B) IR C) GC D) TLC 12) Arson investigators must work quickly to collect evidence at a fire scene because: A) Accelerant
> Which substance has the highest ignition temperature? A) Turpentine B) Fuel oil #2 C) Benzene D) Kerosene 2) Telltale signs of arson include: A) Separate points of origin. B) Trails of burn patterns. C) The presence of accelerant containers. D)
> Each cycle of the DNA Thermal Cycler takes approximately: A) 30 seconds. B) 4 hours. C) 2 hours. D) 2 minutes. 42) STRs normally consist of repeating sequences of: A) 13-17 bases. B) 18-2 bases. C) 3-7 bases. D) 8-12 bases. 43) The amount of DNA
> The specific proteins produced by a cell are directly related to the: A) Sequence of nucleotides in the DNA of the cell. B) Number of mitochondria in the cell. C) Length of the chromosomes. D) Sequence of sugars and phosphates in the cell. 32) What is
> HV1 and HV2 are: A) Restriction enzymes. B) STR types. C) Types of viruses. D) Regions of mtDNA. 22) Y-STR markers are useful when multiple males are involved in a sexual assault. If three men are involved in such an attack the investigators would ex
> 31) An objective lens with a numerical aperture of 1.50 can separate details at half the distance of a lens with a numerical aperture of: A) 0.65. B) 3.00. C) 30.00. D) 0.75. 32) An object with the letter “L” is viewed under low power of a compound micr
> The PCR technique requires the use of a thermal cycler to: A) Synthesize protein. B) Copy DNA. C) Make probes radioactive. D) Hydrolyze polymerase. 12) In the PCR process, the first step is to heat the DNA strands. This is to permit the: A) DNA to c
> The technology of DNA typing had its beginnings in 1985 with the work of: A) Henry Lee. B) Francis Crick. C) James Watson. D) Alec Jeffreys. 2) DNA is a(n): A) Protein. B) Starch. C) Polymer. D) Enzyme. 3) The molecular structure of DNA was dedu
> During the production of monoclonal antibodies, which step is NOT followed? A) Inject an animal with the antigen of interest. B) Remove the animal’s spleen cells. C) Fuse the spleen cells to malignant blood cells. D) All of the above are followed. 32) A
> What is true about monoclonal antibodies? A) They are produced utilizing rapidly multiplying blood-cancer cells. B) They are produced by injecting a mouse with an antigen. C) They are expected to be medicine’s version of the “magic bullet.” D) All of
> Luminol can be used at crime scenes to: A) Detect traces of blood without compromising potential DNA typing. B) Make hair evidence fluoresce. C) Light up the crime scene with a high degree of illumination. D) Locate latent prints that otherwise would b
> Which blood components are directly pertinent to the forensic aspects of blood identification? A) Platelets B) Blood serum C) Red blood cells D) Both B and C 2) In routine blood banking, which antigen(s) must be determined in testing for compatibil
> Which coating provides resistance to corrosion? A) Electrocoat primer B) Primer surface C) Basecoat D) Clearcoat 22) Which coat represents the “eye appeal”? A) Electrocoat primer B) Primer surface C) Basecoat D) Clearcoat 23) Which property imparts
> The atoms of hydrogen, deuterium, and tritium all have the same number of protons, but differ in the number of neutrons they possess. These substances are: A) Elements. B) Compounds. C) Molecules. D) Isotopes. 12) In neutron activation analysis, an elem
> What type of evidence would be expected to have trace elements? A) Glass and metal objects B) Paint and bullet fragments C) Soil and gun primer particles D) All of the above 2) In a simple emission spectrograph, excitation of the specimen under inve
> A drug recognition expert (DRE) can: A) Identify street drugs by their appearance. B) Help a drug user acknowledge his/her habit and suggest ways to become drug-free. C) Determine whether a person has taken one or more drugs. D) Advise the toxicologis
> When the SEM’s primary electron beam bombards a specimen, it causes the emission of: A) Electrons from elements of the upper layer of the specimen. B) X-rays from the target. C) Gamma rays from the target. D) Both A and B 22) A microscope uses a comb
> The elimination or “burn off” rate of alcohol averages ________ percent w/v per hour. A) 0.10 B) 0.15 C) 0.015 D) None of the above 32) Which of the following drugs is NOT found in blood or urine? A) Morphine B) Heroin C) Amphetamine D) Methadone 33) C
> Carbon monoxide is toxic because it: A) Activates killer white blood cells. B) Destroys red blood cells. C) Causes platelets to clump. D) Combines with hemoglobin to form carboxyhemoglobin. 22) The presence of high levels of carbon monoxide in the bloo
> The federal government set the maximum allowable blood alcohol concentration for commercial truck and bus drivers at: A) 0.08%. B) 0.02%. C) 0.05%. D) 0.04%. 12) After a blood sample is collected for alcohol testing, a(n) ________ is added to stop t
> From each of the following descriptions of bullet holes, estimate the distance from the shooter to the target. a. A few widely scattered gunpowder particles with no soot around the entrance hole b. A dark ring around the bullet hole, but no soot or gunpo
> Describe the best process to analyze and attempt to identify the chemical components of fiber and paint evidence.
> 1) Indicate what type of microscope (compound, comparison, stereoscopic, or polarizing light) should be used to analyze each of the following items of evidence: a. fired bullets b. a synthetic fiber c. soil minerals d. paint chips e. a shed head hair
> In Western countries, what is/are the most heavily abused drug(s)? A) Tranquilizers B) Alcohol C) Barbiturates D) Amphetamines 2) Which is NOT a factor in determining the rate at which alcohol is absorbed into the bloodstream? A) The alcoholic content
> When should an examiner do a physical extraction versus a logical extraction, or both?
> If there is a GPS capability on a smartphone, how might the investigator use it in the investigation?
> List four places where a forensic computer examiner might look to determine what websites a computer user has visited recently. What kind of leads could this information provide to the investigator?
> An investigator would like to take a forensic “image” of a suspect’s HDD. What is the primary goal in obtaining data from a HDD? What tools can the investigator use to achieve this goal?
> A small piece of paper from a hotel notepad is found in the pocket of a potential “hit man” as he attempted to kill his “mark.” The paper shows writing in various pen colors, some of which is obliterated and some of which was erased. The top corner of th
> A threatening letter is received by a company CEO via fax. What characteristics can be examined to gain information about the sending machine, the sending individual, and fraudulent source information?
> A warranted search of a victim’s apartment yields three pages of exemplar handwriting samples written on ruled notebook paper with blue ballpoint pen. The investigators would like to compare the handwriting on these exemplars to a potential suicide note
> Criminalist Matt Hughes arrives at the scene of an explosion. He first carries out a search of the periphery of the crime scene, questions several witnesses, and then locates the crater caused by the blast. After finding the crater, he uses a sifter to s
> The following substances were found at the scenes of explosions. Indicate for each group of items if low, high, or a combination of explosives were used. If high explosives were used, indicate whether the components can be identified as primary or second
> At a fire scene, what characteristics should an investigator look for to identify the fire’s point of origin? What circumstances may affect these characteristics?
> Which of the following analytical technique is considered to be a specific test in a drug identification scheme? A) Color test B) Microcrystalline test C) Thin-layer chromatography D) Infrared spectrophotometry 62) Chromatography is NOT used to: A) Aid
> A large container of gasoline is recovered from the walk-in freezer at a restaurant owned by an arson suspect. The gasoline temperature is found to be -10 degrees Fahrenheit. The suspect claims this gasoline would be too cold to have been used as an acce
> List the differences between nuclear DNA and mitochondrial DNA. What are the advantages and disadvantages of the use of mitochondrial DNA analysis in forensic investigations?
> What are the advantages of using PCR in the analysis of DNA for forensic investigation?
> What three questions must the criminalist answer when examining dried blood? Which tests or analysis tools can be used to answer each question?
> Three blood samples are exposed to the antiserums shown below with the given reactions. Based on these results, determine the ABO/Rh blood type of each sample.
> Why must paint collected from a vehicle involved in a hit-and-run accident be taken from the area of the car suspected of being in contact with the victim?
> Using knowledge about the operation of ICP emission spectrophotometry, determine whether it could or could not be utilized for the following analyses: a. analysis of metals in wine to determine area of origin b. detection of arsenic in a food sample c. c
