CIS 230 Final
In Virtual Box, a(n) ____ file contains settings for virtual hard drives.
.vbox
Which of the following file extensions are associated with VMware virtual machines?
.vmx, .log, and .nvram
Data acquisition is the process of copying data. How many different types of data acquisition are there?
2
Image files can be reduced by as much as ____% of the original.
50
A UNIX/Linux hard link is:
A pointer that allows accessing the same file by different filenames.
Which of these image file formats rarely compress their data or do so inefficiently?
BMP
Which of the following are not common computer forensics tools functions?
Command-line applications and GUI applications
The FBI formed this in 1984 to handle the increasing number of cases involving digital evidence.
Computer Analysis and Response Team (CART)
These records are data the system maintains, such as system log files and proxy server logs.
Computer-generated
In a MAC file system, a file consists of?
Data fork and resource fork.
This involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.
Data recovery
The process of converting raw images to another format is called which of the following?
Demosaicing
You can expect to find a type 2 hypervisor on what type of device?
Desktop
The most common and flexible data-acquisition method is ____.
Disk-to-image file copy
Which of these image file formats was developed by JEIDA as a standard for storing metadata in JPEG and TIFF files?
EXIF
Which of the following Linux file systems added support for partitions larger than 16TB?
Ext4
A forensic lab doesn't need to be physically secure as long as the forensic workstation is secured with a strong password.
False
Advanced hexadecimal editors cannot generate the hash value of selected data sets in a file or sector.
False
All forensic acquisition tools can copy data in the host protected area (HPA) of a disk drive.
False
An officer trained as a Digital Evidence First Responder (DEFR) has the skill to analyze the data and determine when another specialist should be called in to assist with the analysis.
False
Building a forensic workstation is more expensive than purchasing one.
False
Exculpatory evidence, in essence, is the same as inculpatory evidence, meaning it tends to clear the suspect.
False
Hardware acquisition tools typically have built-in software for data analysis
False
ISPs can investigate computer abuse committed by their customers.
False
In a NTFS file system, the backup copy of the Volume Boot Record (VBR) is stored in the third to last sector of the partition.
False
International Copyright laws apply to all Web sites in all countries.
False
Linux is the only OS that has a kernel.
False
Password recovery is included in all forensic tools.
False
Steganography determines ownership of media, such as images downloaded from a website, and the right to use media.
False
The Windows disk partition utility cannot change the disk partition table.
False
The law of search and seizure protects the rights of all people, excluding people suspected of crimes.
False
The unused space between partitions is called the unallocated gap.
False
Two files with different file names but exactly the same data content will have different hash values.
False
UNIX reduces file fragmentation by using clumps, which are groups of contiguous allocation blocks.
False
UNIX was created in the early 1990s to be a multiuser secure OS specifically for mobile phones.
False
Software forensic tools are grouped into which two applications?
GUI and Command-line applications
Which Registry key contains associations for file extensions?
HKEY_CLASSES_ROOT
Digital forensic tools are divided into which two major categories?
Hardware and software
The process of block-wise hashing can be best defined as:
Hashing of sectors to look for known file fragments.
Which best defines Order of Volatility (OOV)?
How long a piece of information lasts on a system.
This was created by police officers who wanted to formalize credentials in computing investigations.
IACIS
The standards for testing forensic tools are based on which criteria?
ISO 17025
Which of these compression methods permanently discards bits of information?
Lossy compression
Areal density refers to which of the following?
Number of bits per square inch of a disk platter
The first rule for all digital investigations is to:
Preserve the evidence
This is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.
Probable cause
The verification function does which of the following?
Proves that two sets of data are identical by calculating hash values
The verification function does which of the following?
Proves that two sets of data are identical via hash values
Which of the following is not a common graphic type:
QuickView
Which digital camera file format is referred to as a digital negative?
RAW
When you carve a graphics file, recovering the image depends on which of the following skills?
Recognizing the pattern of the file header content
A log report in forensic tools does which of the following?
Records an investigator's actions in examining a case
Scope Creep is defined as
Search of data where investigation expands beyond the original description because of unexpected evidence that has been found
Write-blockers protect evidence disks by preventing data from being written to them and can be divided into which two types?
Software and Hardware
Which of the following represents known files you can eliminate from an investigation?
System files the OS uses
Defense contractors during the Cold War were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. The U.S. Department of Defense calls this special computer-emission shielding ____.
TEMPEST
Which of the following is the main challenge in acquiring an image of a Mac OS?
The Mac design and engineering.
UNIX and Linux have four components defining the file system. They include:
The boot block, superblock, inode block, and data block.
The Federal Rules of Evidence (FRE), signed into law in 1973, was created for what purpose?
To ensure consistency in federal proceedings
A digital forensic lab is where you conduct investigations, store evidence, and do most of your work.
True
A forensic image of a VM includes all snapshots?
True
A live acquisition is considered an accepted practice in digital forensics.
True
A way of categorizing computer records is by dividing them into computer-generated records and computer-stored records.
True
Acquisition is the process of creating a duplicate image of data; one of the required functions of digital forensic tools.
True
All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.
True
Digital Evidence can be ANY information stored or transmitted in digital form. Correct!
True
Digital forensic tools have some limitations in performing hashing, however, so using advanced hexadecimal editors is necessary to ensure data integrity.
True
Each type of graphics file has a unique header containing information that distinguishes it from other types of graphic files.
True
Forensics data acquisitions are stored in three formats, raw, proprietary, and AFF.
True
Law enforcement can confiscate anything an arrested person is carrying and log that device, such as a smartphone, was on the person, they don't necessarily have the right or authority to search the device.
True
Macintosh OS X uses the Intel Processor and is UNIX based. Correct!
True
Many password-protected OS's and applications store passwords in the form of MD5 or SHA hash values.
True
One advantage of using command-line tools for an investigation is that they require few system resources because they're designed to run in minimal configurations.
True
One reason to choose a logical acquisition is an encrypted drive.
True
The HFS and HFS+ file systems uses not one but two descriptors for the end of a file (EOF).
True
The plain view doctrine applies when investigators find evidentiary items that aren't specified in a warrant or under probable cause.
True
Validating digital evidence is the most critical aspect of computer forensics. Correct!
True
When attorneys challenge digital evidence, often they raise the issue of whether computer-generated records were altered or damaged after they were created.
True
Your professional conduct as a digital investigator is critical because it determines your credibility.
True
Virtual Machine "Hypervisors" can be divided into how many types:
Two
When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.
U.S. DoJ
What is the space on a drive called when a file is deleted?
Unallocated space
What is one of the most critical aspects of computer forensics?
Validating digital evidence
Which graphic type uses lines instead of dots to make up an image?
Vector
Which of the following is a clue that a virtual machine has been installed on a host system?
Virtual network adapter
During an investigation involving a live computer, do not cut electrical power to the running system unless it's an older ____ or MS-DOS system.
Windows XP
In a criminal or public case, if you have enough information to support a search warrant, the prosecuting attorney might direct you to submit this.
affidavit
This is the route the evidence takes from the time you find it until the case is closed or goes to court.
chain of custody
Confidential business data included with the criminal evidence are referred to as this kind of data.
commingled
For computer forensics, this is the task of collecting digital evidence from electronic media.
data acquisition
To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as this.
forensic workstation
Courts consider evidence data in a computer as ____ evidence.
physical
Evidence is commonly lost or corrupted through this, which involves police officers and other professionals who aren't part of the crime scene processing team.
professional curiosity
In general, a criminal case follows three stages: the complaint, the investigation, and this.
prosecution
Without a warning banner, employees might have an assumed ____ when using a company's computer systems and network accesses.
right of privacy
Environmental and ____ issues are your primary concerns when you're working at the scene to gather information about an incident or a crime.
safety
Real-time surveillance requires ____ data transmissions between a suspect's computer and a network server.
sniffing
Microsoft has added ____ with BitLocker to its newer operating systems, such as Windows 8 and 10, which makes performing static acquisitions more difficult.
whole disk encryption