Quiz 1 Prep

Part 1: Based on Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations document.
• Name two steps involved in forensics analysis of a hard drive
• Briefly explain in your own words the imaging process
• What are 3 categories of computers record.
• Give an example of non-hearsay record

Part 2:
• Convert 17894 to HEX and then to BINARY
• Convert 0xFA1 to BINARY
• Assuming you have a following HEX value in the memory

  HEX Value

  Address	Value
  1000	A0
  1001	C6
  1002	10
  1003	11

  1. Assuming, that the system is Big Endian, find the decimal value of the HEX value written above.

  2. Assuming, that the system is Little Endian, find a decimal value of the HEX value written above

• Assuming you have a following HEX value in the memory

  HEX Value

  Address	Value
  1000	0F
  1001	B1
  1002	A2
  1003	20

  1. Assuming, that the system is Big Endian, find the decimal value of the HEX value written above.

  2. Assuming, that the system is Little Endian, find a decimal value of the HEX value written above