DF FINAL prime
What does the investigator in a criminal or public-sector case submit, at the request of the prosecuting attorney, if he or she has enough information to support a search warrant?
An affidavit
Which uppercase letter has a hexadecimal value 41? "Z" "A" "C" "G"
"A"
In Microsoft Outlook, what file extension is used with saved sent, drafted, deleted, and received e-mails? .msg .pst .ost .eml
.pst
In Linux, in which directory are most system configuration files stored?
/etc
On a Linux computer, what contains group memberships for the local system?
/etc/group
In Linux, in which directory are most applications and commands stored? /home /etc /usr /var
/usr
At what offset is a prefetch file's create date and time located?
0x80
At what offset are the application's last access date and time located in a prefetch file?
0x90
At what distance can the EMR from a computer monitor be picked up? 1/4 mile 3/4 mile 1/2 mile 1 mile
1/2 mile
In the NTFS MFT, all files and folders are stored in separate records of how many bytes each?
1024
What is the largest disk partition Ext4f can support?
16 TB
When was the Freedom of Information Act originally enacted? 1950s 1940s 1960s 1970s
1960s
The Enhanced Data GSM Environment (EDGE) standard was developed specifically for which type of service? OFDM D-AMPS CDMA 3G
3G
In an e-mail address, what symbol separates the domain name from the rest of the address? . # @ -
@
What document, issued by a judge, compels the recipient to do or not do something? A temporary restraining order A court order A warrant A subpoena
A court order
What type of software runs virtual machines? A virtual server A systems mirror A digital simulator A hypervisor
A hypervisor
Which type of tool has application programming interfaces (APIs) that allow reconfiguring a cloud on the fly and is accessed through the application's Web interface?
A management plane
A government entity must show that there is probable cause to believe the contents of a wire communication, an electronic communication, or other records are relevant to an ongoing criminal investigation to obtain which type of order? A court order with prior notice A subpoena A TRO A search warrant
A search warrant
What usually appears when a computer starts or connects to the company intranet, network, or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer systems and network traffic at will? An alarm trigger A consent authorization A warning banner A statement of responsibilities
A warning banner
What do law enforcement investigators need in order to remove computers from a crime scene and transport them to a lab?
A warrant
Which type of kit should include all the tools the investigator can afford to take to the field? A forensic lab kit An extensive-response field kit A forensic workstation kit An initial-response field kit
An extensive-response field kit
What is needed to quickly acquire data at a scene and return to the lab?
An initial-response field kit
What will allow the investigator to arrive at a scene, acquire the needed data, and return to the lab as quickly as possible? An initial-response field kit An extensive-response field kit A seizing order A bit-stream copy utility
An initial-response field kit
Where should your computer backups be kept? Any convenient location A colleague's computer In the Cloud An off-site facility
An off-site facility
Power should not be cut during an investigation involving a live computer, unless it is what type of system?
An older Windows or MS-DOS system
What term refers to the number of bits in one square inch of a disk platter? ZBR Cylinder skew Areal density Head skew
Areal density
Which tool probes, collects, and analyzes session data? Pcap TCPcap Nmap Argus
Argus
How may computer programs be registered under copyright laws? As audiovisual works As motion pictures As architectural works As literary works
As literary works
In Web-based e-mail, how are messages displayed and saved? As CSS codes As web pages As .txt files As .rtf files
As web pages
What specifies the Windows XP path installation and contains options for selecting the Windows version?
Boot.ini
What type of attacks use every possible letter, number, and character found on a keyboard when cracking a password?
Brute-force
In what process is the acquisition of newer and better resources for investigation justified? Modifying the configuration plan Building a business case Conducting a risk evaluation Creating an upgrade policy
Building a business case
Which folder is most likely to contain Dropbox files for a specific user?
C:\Users\username\Dropbox
What technology, developed during WWII, uses the full radio spectrum to define channels and is now used in the U.S. by Sprint, U.S. Cellular, and Verizon?
CDMA
What HTCN certification level requires candidates have three years of experience in computing investigations for law enforcement or corporate cases? Certified Computer Crime Investigator, Advanced Level Certified Computer Forensic Technician, Basic Certified Computer Forensic Technician, Advanced Certified Computer Crime Investigator, Basic Level
Certified Computer Forensic Technician, Basic
Which organization has developed resource documentation for cloud service providers and their staff and provides guidance for privacy agreements, security measures, and other issues? OpenStack Framework Alliance Cloud Security Alliance Cloud Architecture Group Cloud Security Advisory Panel
Cloud Security Alliance
Which entity was formed by the FBI in 1984 to handle the increasing number of cases involving digital evidence?
Computer Analysis and Response Team
What process refers to recording all the updates made to a workstation? Configuration management Recovery logging Change logging Risk minimization
Configuration management
What type of laws should computer investigators be especially aware of when working with image files in order to avoid infringement violations? Copyright International Civil Forensics
Copyright
What type of laws should computer investigators be aware of when working with image files?
Copyright laws
Which type of case involves charges such as burglary, murder, or molestation? Judicial Criminal Civil Corporate
Criminal
What term refers to a column of tracks on two or more disk platters? Cylinder Sector Head Track
Cylinder
Which type of network is a digital version of the original analog standard for cell phones?
D-AMPS
Which activity involves changing or manipulating a file to conceal information?
Data hiding
A technician is trying to recover information on a computer that has been hidden or deleted on purpose in order to hide evidence of a crime. Which type of task is the technician performing?
Data recovery
What contains instructions for the OS for hardware devices, such as the keyboard, mouse, and video card? Pagefile.sys Device drivers Hal.dll Ntoskrnl.exe
Device drivers
What contains instructions for the OS for hardware devices? Pagefile.sys Device drivers Hal.dll Ntoskrnl.exe
Device drivers
What are packet analyzers?
Devices or software placed on a network to monitor traffic
What type of plan specifies how to rebuild a forensic workstation after it has been severely contaminated by a virus from a drive you're analyzing? Risk management Disaster recovery Configuration management Security
Disaster recovery
What type of copy does the simplest method of duplicating a disk drive make? Partition-to-partition Image-to-partition Image-to-disk Disk-to-image
Disk-to-image
Which type of copy from the suspect disk to the target location does the simplest method of duplicating a disk drive make? Disk-to-image Partition-to-partition Image-to-disk Image-to-partition
Disk-to-image
What older Microsoft disk compression tool eliminates only slack disk space between files? WinZip PKZip WinRAR DriveSpace
DriveSpace
What tool provided by Paraben Software examines IoT devices, has a bootloader for locked mobile devices, and can perform data parsing and cloud data capture? BitPim E3:DS MOBILedit! DataPilot
E3:DS
Where do phones typically store system data? EROM ROM PROM EEPROM
EEPROM
In which format are most digital photographs stored?
EXIF
What term refers to a person using a computer to perform routine tasks other than systems administration? Customer Consumer Complainant End user
End user
Which tool allows network traffic to be viewed graphically?
Etherape
What type of files might lose essential network activity records if power is terminated without a proper shutdown?
Event logs
If a graphics file cannot be opened in an image viewer, what should the next step be?
Examining the file's header data
What must be included in an affidavit to support the allegation of a crime when seeking a search warrant? Exhibits Authorized requester Subpoena Exculpatory evidence
Exhibits
When an investigator seeks a search warrant, which of the following must be included in an affidavit to support the allegation of a crime?
Exhibits
What was the early standard Linux file system? Ext2 NTFS HFS+ Ext3
Ext2
The data-hiding technique involving marking bad clusters is more commonly used with what type of file system? Ext2fs NTFS HFS FAT
FAT
Which activity involves sorting and searching through investigation findings to separate good data and suspicious data?
Filtering
In which discipline do professionals listen to voice recordings to determine who's speaking or read e-mail and other writings known to be by a certain person and determine whether that person wrote the e-mail or letter in question? Communication forensics Forensic linguistics Linguistic analysis Communication linguistics
Forensic linguistics
Which resource can be helpful when investigating older and unusual computing systems? Minix Uniform reports AICIS lists Forums and blogs
Forums and blogs
How many components define the file system on UNIX/Linux? Three Two Four Five
Four
What tools are used to create, modify, and save bitmap, vector, and metafile graphics? Image readers Image viewers Graphics viewers Graphics editors
Graphics editors
Because digital forensics tools have limitations in performing hashing, what tools should be used to ensure data integrity? Steganalysis tools High-level language assemblers Hexadecimal editors HTML editors
Hexadecimal editors
Which project was developed to make information widely available in an attempt to thwart Internet and network hackers? Honeynet Honeypot Honeywall Honeyweb
Honeynet
What organization was created by police officers in order to formalize credentials for digital investigators? TEMPEST IACIS NISPOM HTCN
IACIS
Which agency introduced training on software for forensics investigations by the early 1990s? IACIS DDBIA CERT FLETC
IACIS
Which standard introduced sleep mode to enhance battery life? IS-195 IS-236 IS-361 IS-136
IS-136
Which standards document demands accuracy for all aspects of the testing process? ISO 17025 ISO 5321 ISO 5725 ISO 3657
ISO 5725
In a file's inode, what are the first 10 pointers called? Triple pointers Indirect pointers Double pointers Direct pointers
Indirect pointers
What contains file and directory metadata and provides a mechanism for linking data stored in data blocks? Extnodes InfNodes Inodes Xnodes
Inodes
Which is the most accurate statement about investigating and controlling computer incident scenes in private-sector environments as compared to crime scenes? Investigating and controlling the scene is equally difficult in both environments. Investigating and controlling the scene is much easier in private sector environments. Investigating and controlling the scene is equally easy in both environments. Investigating and controlling the scene is more difficult in private sector environments.
Investigating and controlling the scene is much easier in private sector environments.
Which JFIF format has a hexadecimal value of FFD8 FFE0 in the first four bytes? JPEG EPS BMP GIF
JPEG
What term is often used when discussing Linux? Module Root Kernel GRUB
Kernel
What technology is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure? Key escrow Passphrase splitting Passphrase escrow Key splitting
Key escrow
When both the original file with no hidden message and the converted file with the hidden message are available, what analysis method is recommended by Johnson and Jajodia? Message-only attack Known cover attack Known message attack Chosen message attack
Known cover attack
Which type of strategy hides the most valuable data at the innermost part of the network?
Layered network defense
On which OSI model layers do most packet analyzers operate? Layers 1 or 2 Layers 2 or 3 Layers 4 or 5 Layers 3 or 4
Layers 2 or 3
What do published company policies provide for a business that enables them to conduct internal investigations? Judicial authorization Line of authority Legitimate justification Absolute process
Line of authority
What term refers to Linux ISO images that can be burned to a CD or DVD? Linux in a Box Linux Live CDs ISO CDs Forensic Linux
Linux Live CDs
What type of acquisition is done if the computer has an encrypted drive and the password or passphrase is available? Static Passive Live Local
Live
Which files provide helpful information to an e-mail investigation?
Log and configuration files
What does Autopsy use to validate an image? MD5 AFD AFF RC4
MD5
What is on an NTFS disk immediately after the Partition Boot Sector? HPFS MFT FAT MBR
MFT
Which tool enables the investigator to acquire the forensic image and process it in the same step?
Magnet AXIOM
What are records in the MFT called?
Metadata
Which tool, used by government agencies, retrieves data from smartphones, GPS devices, tablets, music players, and drones? MOBILedit Forensic Micro Systemation XRY DataPilor BitPim
Micro Systemation XRY
At what levels should lab costs be broken down? Daily, weekly, and monthly Monthly, quarterly, and annually Weekly, monthly, and annually Monthly, bimonthly, and quarterly
Monthly, quarterly, and annually
Which filename refers to a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to Ntldr? BootSect.dos NTDetect.com Hal.dll Boot.ini
NTDetect.com
In addition to FAT16, FAT32, and Resilient File System, which file system can Windows hard disks also use? FAT24 ext3 NTFS ext2
NTFS
Which acronym refers to the file system that was introduced when Microsoft created Windows NT and that remains the main file system in Windows 10? NTFS HPFS FAT32 VFAT
NTFS
Which cloud forensics training program is limited to law enforcement personnel? National Institute of Justice Digital Forensics Training INFOSEC Institute (ISC)2 Certified Cyber Forensics Professional Sans Cloud Forensics with F-Response
National Institute of Justice Digital Forensics Training
Which tool was designed as an easy-to-use interface for inspecting and analyzing large tcpdump files?
Netdude
Which filename refers to the Windows XP system service dispatch stubs to executables functions and internal support functions? Ntdll.dll Gdi32.dll User32.dll Advapi32.dll
Ntdll.dll
Which filename refers to the physical address support program for accessing more than 4 GB of physical RAM? Hal.dll Ntkrnlpa.exe Io.sys BootSect.dos
Ntkrnlpa.exe
What is Microsoft's SkyDrive now called? Teams Box OneDrive MS Drive
OneDrive
Which devices have been replaced by iPods, iPads, and other mobile devices for personal use? MMCs PDAs CFs SDHCs
PDAs
Which format can be read by most packet analyzer tools? DOPI Pcap AIATP SYN
Pcap
Without a warning banner, what right might employees assume they have when using a company's computer systems and network accesses? Authority Privacy Consent Anonymity
Privacy
What investigator characteristic determines the investigator's credibility? Fidelity to oath of office Investigatory acumen Line of authority Professional conduct
Professional conduct
What investigator characteristic, which includes ethics, morals, and standards of behavior, determines the investigator's credibility? Investigatory acumen Fidelity to oath of office Professional conduct Line of authority
Professional conduct
The presence of police officers and other professionals who aren't part of the crime scene-processing team may result in the loss or corruption of data through which process? Deliberate destruction Professional curiosity Data drift Police malfeasance
Professional curiosity
Which type of format acquisition leaves the investigator unable to share an image between different vendors' computer forensics analysis tools? AFF AFD Raw Proprietary
Proprietary
In which RAID configuration do two or more disk drives become one large volume, so the computer views the disks as a single disk?
RAID 0
In addition to RAID 0, what type of RAID configuration is available for Windows XP, 2000, and NT servers and workstations? RAID 4 RAID 1 RAID 5 RAID 2
RAID 1
Which RAID configuration offers the greatest access speed and most robust data recovery capability?
RAID 15
At a minimum, what do most company policies require that employers have in order to initiate an investigation?
Reasonable suspicion that a law or policy is being violated.
In older versions of macOS, in which fork are file metadata and application information stored? Block Node Inode Resource
Resource
Which activity involves determining how much risk is acceptable for any process or operation? Risk control Risk analysis Risk configuration Risk management
Risk management
What is the primary hash algorithm used by the NIST project created to collect all known hash values for commercial software and OS files?
SHA-1
Which hashing algorithm is provided by WinHex? CRC AES RC4 SHA-1
SHA-1
What type of cards, consisting of a microprocessor and internal memory, are usually found in GSM devices? SIM MMC SDD SD
SIM
What type of disk is commonly used with Sun Solaris systems?
SPARC
In addition to environmental issues, what issues are the investigator's primary concerns when working at the scene to gather information about an incident or a crime? Safety Legal Corporate Interpersonal
Safety
What cloud application offers a variety of cloud services, including automation and CRM, cloud application development, and Web site marketing?
Salesforce
What action alters hash values, making cracking passwords more difficult? Salting passwords Rainbow tabling Code twisting Hash morphing
Salting passwords
Which action alters hash values, making cracking passwords more difficult? Hash morphing Rainbow tabling Salting passwords Code twisting
Salting passwords
To view Gmail Web e-mail headers, what should be clicked after the e-mail has been opened and the down arrow next to the Reply circular arrow has been clicked? Options Show original Message properties More options
Show original
Which doctrine, found to be unconstitutional, was used to allow a civilian or private-sector investigative agent to deliver evidence obtained in a manner that violated the Fourth Amendment to a law enforcement agency?
Silver-platter
With cloud systems running in a virtual environment, what can be used to give the investigator valuable information before, during, and after an incident?
Snapshots
What is required for real-time surveillance of a suspect's computer activity?
Sniffing data transmissions between a suspect's computer and a network server.
In which cloud service level are applications delivered via the Internet?
Software as a service
If your time is limited, what type of acquisition data copy method should you consider?
Sparse
What type of acquisition is typically done on a computer seized during a police raid? Online Static Real-time Live
Static
What material is recommended for secure storage containers and cabinets? Expanded metal Steel Gypsum Wood
Steel
What is another term for steganalysis tools? Hexadecimal editors Steg tools Image editors Image tools
Steg tools
Which term comes from the Greek word for 'hidden writing'? Hagiography Lexicography Steganography Cryptography
Steganography
Which term refers to a data-hiding technique that uses host files to cover the contents of a secret message? Steganos Steganography Graphie Steganalysis
Steganography
Which data-hiding technique replaces bits of the host file with other bits of data?
Substitution
During the Cold War, defense contractors were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. What did the U.S. Department of Defense call this special computer-emission shielding?
TEMPEST
From which file format is the image format XIF derived? BMP JPEG TIF GIF
TIF
Which digital forensics tool is categorized as a single-purpose hardware component? AccessData FTK Safeback Tableau T35es-R2 SATA/IDE eSATA bridge Magnet Forensics AXIOM
Tableau T35es-R2 SATA/IDE eSATA bridge
Which program can be used to examine network traffic? Slackdump Tcpdump Coredump Netdump
Tcpdump
Which tool is useful for extracting information from large Libpcap files? Oinkmaster Memfetch Tcpslice John
Tcpslice
What entity created the Interim Standards used in mobile communications? Global Telecommunications Association International Telecommunications Union Telecommunications Industry Association Global System Communications Industry
Telecommunications Industry Association
Which network protocol analyzer can be programmed to examine TCP headers to find the SYN flag? Memfetch Tethereal Memorizer John
Tethereal
What macOS system application tracks each block on a volume to determine which blocks are in use and which ones are available to receive data? Then Extents Overflow File The Volume Bitmap The Volume Control Block The Master Directory Block
The Volume Bitmap
Where are directories and files stored on a disk drive? The boot block The superblock The inode block The data block
The data block
In macOS, which fork typically contains data the user creates? The user fork The data fork The content fork The resource fork
The data fork
What is the main information being sought when examining e-mail headers?
The originating e-mail's domain name or an IP address
When Microsoft created Windows 95, into what were initialization (.ini) files consolidated? The registry The metadata The inidata The inirecord
The registry
In macOS, when working with an application file, which fork contains additional information, such as menus, dialog boxes, icons, executable code, and controls? The resource fork The system fork The data fork The application fork
The resource fork
What does the SIM file structure begin with? Directory files (DF) The root of the system (MF) Elementary data (EF) Network data (DCS)
The root of the system (MF)
What limits the data that can be sought in a criminal investigation? The applicable administrative rule The search warrant The agency's policies and procedures The legal definition of the purported crime
The search warrant
What technique does GSM use, in which multiple phones take turns sharing a channel? Code Division Multiple Access Time Division Multiple Access Enhanced Data GSM Environment Orthogonal Frequency Division Multiplexing
Time Division Multiple Access
In which log does Exchange log information about changes to its data? Communication Checkpoint Tracking Transaction
Transaction
Which type of virtual machine software is typically, but not exclusively, loaded on servers or workstations with a lot of RAM and storage? Type 2 Type 1 Type 3 Type 4
Type 1
When seizing computer evidence in criminal investigations, which organization's standards should be followed? NSA U.S. DOJ U.S. DoD Department of Homeland Security
U.S. DOJ
Devices used to prevent data from being written to a disk can connect to a computer through FireWire, SATA, PATA, and SCSI controllers as well as which other type of controller? PCMCIA IDE USB 2.0 and 3.0 LCD
USB 2.0 and 3.0
What reports are generated at the local, state, and federal levels to show the types and frequency of crimes committed?
Uniform crime reports
How much internal memory do mobile devices have? Up to 8 GB Up to 16 GB Up to 32 GB Up to 64 GB
Up to 64 GB
What is the simplest way to access a file header? Use a hexadecimal editor Use a disk editor Use a text editor Use an image editor
Use a hexadecimal editor
Which filename refers to a core Win32 subsystem DLL file? Ntoskrnl.exe Hal.dll User32.sys Pagefile.sys
User32.sys
Which product responded to the need for security and performance by producing different CPU designs? Parallels Virtualization KVM Virtualization Technology (VT) Hyper-V
Virtualization Technology (VT)
What did Microsoft add to its newer operating systems that makes performing static acquisitions more difficult? Whole disk encryption Backup utilities NTFS Recovery wizards
Whole disk encryption
What cloud service provides a freeware type 1 hypervisor used for public and private clouds? HP Helion Amazon EC2 Cisco Cloud Computing XenServer and XenCenter Windows Management Console
XenServer and XenCenter Windows Management Console
How do most manufacturers deal with a platter's inner tracks having a smaller circumference than its outer tracks? Cylinder skew ZBR Head skew Areal density
ZBR
What term is used for the machines used in a DDoS attack? Zombies Dupes Soldiers Pawns
Zombies
When confidential business data are included with the criminal evidence, what are they referred to as? a. commingled data b. exposed data c. public data d. revealed data
a. commingled data
What command works similarly to the dd command but has many features designed for computer forensics acquisitions? man raw bitcopy dcfldd
dcfldd
What Linux command is used to create the raw data format? rawcp dd d2dump dhex
dd
Which Windows disk partition utility can be used to hide partitions?
diskpart
Which Dropbox file stores information on shared directories associated with a Dropbox user account and file transfers between Dropbox and the client's system? filecache.dll filetx.log read_filejournal filecache.dbx
filecache.dbx
What option is used with the dcfldd command to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512?
hash
What command displays pages from the online help manual for information on Linux commands and their options? hlp cmd man inst
man
What format is used for the flat plaintext files some e-mail systems use for message storage?
mbox
Which Google Drive file contains a detailed list of a user's cloud transactions?
sync_log.log