Computer Forensics Chapter 9

The National Software Reference Library provides what type of resource for digital forensics examiners? a. A list of MD5 and SHA1 hash values for all known OSs and applications b. Reference books and materials for digital forensics c. A list of digital forensics tools that make examinations easier d. A repository for software vendors to register their developed applications

a. A list of MD5 and SHA1 hash values for all known OSs and applications

The likelihood that a brute-force attack can succeed in cracking a password depends heavily on the password length. a. True b. False

a. true

In steganalysis, cover-media is which of the following? a. The file a steganography tool uses to host a hidden message, such as a JPEG or an MP3 file b. The type of steganographic method used to conceal a message c. A specific type of graphics file used only for hashing steganographic files d. The content of a file used for a steganography message

a. The file a steganography tool uses to host a hidden message, such as a JPEG or an MP3 file

Commercial encryption programs often rely on key escrow technology to recover files if a password or passphrase is lost. a. True b. False

a. True

Scope creep happens when an investigation goes beyond the bounds of its original description. a. true b. false

a. true

Which of the following represents known files you can eliminate from an investigation? a. Any files pertaining to the company b. Files associated with an application c. Any graphics files d. All of the above

b. Files associated with an application

Steganography is used for which of the following purposes? a. Validating data b. Hiding data c. Accessing remote computers d. Creating strong passwords

b. Hiding data

Suppose you're investigating an e-mail harassment case. Generally, is collecting evidence for this type of case easier for an internal corporate investigation or a criminal investigation? a. Criminal investigation because subpoenas can be issued to acquire any needed evidence quickly b. Internal corporate investigation because corporate investigators typically have ready access to company records c. Criminal investigation because law enforcement agencies have more resources at their disposal d. Internal corporate investigation because ISPs almost always turn over e-mail and access logs when requested by a large corporation

b. Internal corporate investigation because corporate investigators typically have ready access to company records

Block-wise hashing has which of the following benefits for forensics examiners? a. Provides a faster way to shift bits in a block or sector of data b. Provides a method for hashing sectors of a known good file that can be used to search for data remnants on a suspect's drive c. Allows validating sector comparisons between known files d. Verifies the quality of OS files

b. Provides a method for hashing sectors of a known good file that can be used to search for data remnants on a suspect's drive

After you shift a file's bits, the hash value remains the same. a. true b. false

b. false

Password recovery is included in all forensics tools. a. true b. false

b. false

For which of the following reasons should you wipe a target drive? a. To ensure the quality of digital evidence you acquire b. To make sure unwanted data isn't retained on the drive c. Both a and b d. Neither of the above

c. Both a and b

Rainbow tables serve what purpose for digital forensics examinations? a. Rainbow tables are a supplement to the NIST NSRL library of hash tables. b. Rainbow tables are designed to enhance the search capability of many digital forensics examination tools. c. Rainbow tables contain computed hashes of possible passwords that some password-recovery programs can use to crack passwords. d. Rainbow tables provide a scoring system for probable search terms.

c. Rainbow tables contain computed hashes of possible passwords that some password-recovery programs can use to crack passwords.

If an application uses salting when creating passwords, what concerns should a forensics examiner have when attempting to recover passwords? a. Salting applies only to OS startup passwords, so there are no serious concerns for examiners. b. There are no concerns because salting doesn't affect password-recovery tools. c. Salting can make password recovery extremely difficult and time consuming. d. The effect on the computer's CMOS clock could alter files' date and time values.

c. Salting can make password recovery extremely difficult and time consuming.

The Known File Filter (KFF) can be used for which of the following purposes? a. Filter known program files from view. b. Calculate hash values of image files. c. Compare hash values of known files with evidence files. d. Both a and c

d. Both a and c

You're using Disk Management to view primary and extended partitions on a suspect's drive. The program reports the extended partition's total size as larger than the sum of the sizes of logical partitions in this extended partition. What might you infer from this information? a. The drive is formatted incorrectly. b. The disk is corrupted. c. Nothing; this is what you'd expect to see. d. There's a hidden partition.

d. There's a hidden partition.

Which forensic image file format creates or incorporates a validation hash value in the image file? a. AFF b. SMART c. Expert Witness d. All of the above

d. all of the above