CJ386-Unit 7 Review A questioned document is any material that contains marks, symbols or signs conveying a meaning or message and whose source or authenticity is in question. Questioned documents are not restricted to pieces of paper bearing handwritten text, but also include computer printing, typewritten material, and markings such as graffiti on walls, and other surfaces. The single most common activity of the forensic document examiner is the identification of handwriting. High quality known samples of handwriting (exemplars) are required for handwriting comparisons. Document examiners also compare typewritings, photocopier copies, and computer printed documents. Document examiners are also called upon to compare samples of ink and paper.

Unit 8 Seminar-Chapter 19 Questions What is computer forensics? Name some crimes that involve the use of a computer. What is the difference between computer hardware and computer software? What is the main circuit board of a computer called?

Unit 8 Seminar- Chapter 19 Questions What part of a computer, found on the ‘Mother Board’ contains a complex of wires, which serves to carry data from one hardware device to another? What part of a computer is referred to as the ‘brain’ of the computer? Is the operating system in a computer considered to be hardware or software?

Unit 8 Seminar-chapter 19 Questions What does the term ‘bit’ stand for? What is the first thing a crime scene investigator should do when encountering computer forensic evidence? What are the two ways that a computer crime scene must be documented?

Unit 6 chapter 15 Questions What is the difference between visible data and latent data? What is an IP address and what potential value does it have in computer forensics investigations? What is the unauthorized intrusion into a computer called?

Unit 8-Computer Forensics Review The first thing a computer investigator must do is obtain a search warrant Images of a hard disk drive must be captured without altering the drive in any way Latent data is hidden from view The word processing or text-based document files are a common place to look for evidential data A ‘fingerprint’ must be made of the hard disk drive both before and after imaging its contents Cookies, internet history and cache are all potential sources of evidence on a computer