Chapter 09: Digital Forensics Analysis and Validation

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Brute-force

One way to hide partitions is with the Windows disk partition utility, ____.

diskpart

You begin a digital forensics case by creating a(n) ____.

investigation plan

The term ____ comes from the Greek word for "hidden writing."

steganography

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

subpoenas

Private-sector cases, such as employee abuse investigations, might not specify limitations in recovering data.

True

Several password-cracking tools are available for handling password-protected data or systems.

True

Some encryption schemes are so complex that the time to crack them can be measured in days, weeks, years, and even decades.

True

The defense request for full discovery of digital evidence applies only to criminal cases in the United States.

True

People who want to hide data can also use advanced encryption programs, such as PGP or ____.

BestCrypt

Progressing to make any current encryption schemes obsolete

Quantum computing

A file containing the hash values for every possible password that can be generated from a computer's keyboard

Rainbow table

WinHex provides several hashing algorithms, such as MD5 and ____.

SHA-1

Designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure

Salting password

____ alters hash values, which makes cracking passwords more difficult.

Salting passwords

Limit a civil investigation

Court orders for discovery

The original file with no hidden message

Cover-media

Program used to clean all data from the target drive you plan to use

Digital Intelligence PDWipe

____ have some limitations in performing hashing, however, so using advanced ____ is necessary to ensure data integrity.

Digital forensics tools, hexadecimal editors

____ increases the time and resources needed to extract, analyze, and present evidence.

Scope creep

Marking bad clusters data-hiding technique is more common with ____ file systems.

FAT

Autopsy for Windows cannot analyze data from image files from other vendors.

False

Autopsy for Windows cannot perform forensics analysis on FAT file systems.

False

Most organizations keep e-mail for longer than 90 days.

False

When viewing two files that look the same, but one has an invisible digital watermark, they appear to be the same file, except for their sizes.

False

Defines the investigation's goal and scope, the materials needed, and the tasks to perform

Investigation plan

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.

KFF

Many password-protected OSs and applications store passwords in the form of ____ or SHA hash values.

MD5

To enhance searching for and eliminating known OS and application files, Autopsy has an indexed version of the NIST ____ of MD5 hashes.

NSRL

A password recovery program available from AccessData

PRTK

____ recovery is becoming more common in digital forensic analysis.

Password

____ is defined as hiding messages in such a way that only the intended recipient knows the message is there.

Steganography

The converted cover-media file that stores the hidden message

Stego-media

For static acquisitions, remove the original drive from the computer, if practical, and then check the date and time values in the system's CMOS.

True

For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses.

True

One of the most critical aspects of computer forensics

Validating digital evidence

The data-hiding technique ____ changes data from readable code to data that looks like binary executable code.

bit-shifting

Data ____ involves changing or manipulating a file to conceal information.

hiding

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

key escrow

Criminal investigations are limited to finding data defined in the search ____.

warrant