Computer Forensics Chapter 6

¡Supera tus tareas y exámenes ahora con Quizwiz!

T or F. A live acquisition can be replicated.

False

T or F. Building a forensic workstation is more expensive than purchasing one.

False

T or F. Data can't be written to disk with a command-line tool.

False

T or F. Hardware acquisition tools typically have built-in software for data analysis.

False

T or F. In testing tools, the term "reproducible results" means that if you work in the same lab on the same machine, you generate the same results.

False

T or F. When using a write-blocking device you can't remove and reconnect drives without having to shut down your workstation.

False

Forensics software tools are grouped into ______ and ______ applications. Portable, Desktop Local, remote GUI, command-line Mobile, PC

GUI, command-line

The reconstruction function is needed for which of the following purposes? Re-create a suspect drive to show what happened. Create a copy of a drive for other investigators. Re-create a drive compromised by malware. All of the above

All of the above

When validating the results of a forensic analysis, you should do which of the following? Calculate the hash value with two different tools. Repeat the steps used to obtain the digital evidence, using the same tool, and recalculate the hash value to verify the results. Use a command-line tool and then a GUI tool. None of the above

Calculate the hash value with two different tools.

The standards for testing forensics tools are based on which criteria? ISO 17025 U.S. Title 18 ASTD 1975 All of the above

ISO 17025

Which of the following is true of most drive-imaging tools? They perform the same function as a backup. They ensure that the original drive doesn't become corrupt and damage the digital evidence. They must be run from the command line. All of the above

They ensure that the original drive doesn't become corrupt and damage the digital evidence.

T or F. An encrypted drive is one reason to choose a logical acquisition.

True

T or F. Data viewing, keyword searching, decompressing are three subfunctions of the extraction function.

True

T or F. The primary hashing algorithm the NSRL project uses is SHA-1.

True

Hash values are used for which of the following purposes? Determining file size Filling disk slack Reconstructing file fragments Validating that the original data hasn't changed

Validating that the original data hasn't changed

Hashing, filtering, and file header analysis make up which function of digital forensics tools? Validation and verification Acquisition Extraction Reconstruction

Validation and verification

According to ISO standard 27037, which of the following is an important factor in data acquisition? The DEFR's competency The DEFR's skills in using the command line Conditions at the acquisition setting None of the above

The DEFR's competency

The verification function does which of the following? Proves that a tool performs as intended Creates segmented files Proves that two sets of data are identical via hash values Verifies hex editors

Proves that two sets of data are identical via hash values

A log report in forensics tools does which of the following? Tracks file types Monitors network intrusion attempts Records an investigator's actions in examining a case Lists known good files

Records an investigator's actions in examining a case


Conjuntos de estudio relacionados

finanacing higher education everfi module 6

View Set

NU273 Week 2 PrepU: Assessing Nutritional Status

View Set

Ch. 37 Epidemiology and Public Health Microbiology

View Set

Medication Administration and the Nursing Process of Drug Therapy

View Set

Macroeconomics Chapter 11: Unemployment and Labor Force Participation

View Set

World History B Unit 13: World History Semester Exam

View Set

Virginia Real Estate License Exam

View Set