Varsha

T3 2021: ICT741 Digital Forensics

Tutorial 11

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 11 Compiled by: Dr Saeid Iranmanesh Date Dec 5, 2021

 Review Questions

1. What kind of information do fact witnesses provide during testimony?

Facts only and Observations of the results of tests they performed
2. What expressions are acceptable to use in testimony to respond to a
question for which you have no answer?
That's beyond the scope of my expertise, I wasn't asked to investigate that and That's
beyond the scope of my investigation
3. List two types of depositions.
Testimony preservation and Discovery
4. At trial as a fact or expert witness, what must you always remember
about your testimony?
Your duty is to report your technical or scientific findings or render an honest opinion
5. Before testifying, you should do.
Create an examination plan with your retaining attorney, Make sure you've been paid
for your services and the estimated fee for the deposition or trial
6. Voir dire is the process of qualifying a witness as an expert. True or False?
True
7. What is a motion in limine?
A pretrial motion for the purpose of excluding certain evidence
8. During your cross-examination, What you should do?
Maintain eye contact with the jury, Pay close attention to what your attorney is
objecting to and Answer opposing counsel's questions as briefly as is practical
9. The most reliable way to ensure that jurors recall testimony is to do which
of the following?
Present evidence combining oral testimony and graphics the support the testimony
10. If you’re giving an answer that you think your attorney should follow up
on, what should you do?
Use an agreed-on expression to alert the attorney to follow up on the question
11. When working for a prosecutor, what should you do if the evidence you
found appears to be exculpatory and isn’t being released to the defense?
Bring the information to the attention of the prosecutor, then his or her supervisor, and
finally to the judge
12. Describe two types of ethical standards.
Standards that others apply to you or that you're compelled to adhere to by external
forces (such as licensing bodies) and your own internal rules you use to measure your
performance.
13. Ethical obligations are duties that you owe only to others. True or False?

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 11 Compiled by: Dr Saeid Iranmanesh Date Dec 5, 2021

 False
14. List three sound reasons for offering a different opinion from one you
testified to in a previous case.
Recent developments in technology, New tools with new capabilities and The facts of
the current case being distinguishable from a previous case.
15. All expert witnesses must be members of associations that license them.
True or False?
False
16. Contingency fees can be used to compensate an expert under which
circumstances?
When the expert is acting only as a consultant, not a witness.
17. List three organizations that have a code of ethics or conduct.
 ISFCE
 IACIS
 AMA
 APA
 ABA
18. What purpose does making your own recording during a deposition
serve?
It allows you to review your testimony with your attorney during breaks.
19. Describe an unethical technique opposing counsel might use to make a
deposition difficult for you.
Opposing counsel might attempt to make discovery depositions physically
uncomfortable.
Other tactics include the attorney who has set the deposition neglecting to have
payment ready for you.
20. What are some risks of using tools you have created yourself?
You might have to share the tool's source code with opposing counsel for review

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 11 Compiled by: Dr Saeid Iranmanesh Date Dec 5, 2021

 Quick Quiz 1
1. When you give technical or scientific testimony, you present evidence and explain
what it is and how it was obtained. You don’t offer conclusions, only the facts.

2. Your curriculum vitae (CV) lists your professional experience and is used to qualify
your testimony.

3. Jurors typically average just over12 years of education and an eighth-grade reading
level.

4. Conflicting out is an attempt from one attorney to prevent another attorney from
using you on an important case.

5. Sometimes opposing attorneys ask several questions inside one question; this is called
a(n) compound.

6. A(n) deposition differs from trial testimony because there’s no jury or judge.

7. Although a(n) discovery deposition can be video recorded, a written transcript is

more common and is required in addition to the video recording.

8. A(n) Testimony preservation deposition is usually requested by your client to

preserve your testimony in case of schedule conflicts or health problems.

9. A(n) judicial hearing is held in court to determine the admissibility of certain

evidence before trial.

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 11 Compiled by: Dr Saeid Iranmanesh Date Dec 5, 2021

 Quick Quiz 2

1. Ethics are the rules you internalize and use to measure your performance.

2. One of the effects of violating court rules or laws is disqualification. This outcome
isn’t usually punitive, but it can be embarrassing for you as a professional and
potentially for the attorney who retained you.

3. True or False: Contingency fees aren’t allowed except in certain limited

circumstances.

True

4. True or False: The American Bar Association (ABA) is a licensing body.

False

5. True or False: Evidence obtained through the use of personally created tools is not
admissible in U.S. District courts.

False

6. True or False: Enforcing any professional organization’s ethical guidelines is difficult.

True
7. True or False: The planning stage should cover all possibilities, including giving an
opinion of whether data was corrupted intentionally or unintentionally.

False
8. A(n) orphan file is a file or folder that has lost its link to the parent folder.

9. True or False: Typically, disk drives that haven’t been defragmented have large files
fragmented into one or more data runs.

False
10. True or False: Evidence obtained through the use of personally created tools is not
admissible in U.S. District courts.

True

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 11 Compiled by: Dr Saeid Iranmanesh Date Dec 5, 2021