CCT 240 MT
5. Clusters in Windows always begin numbering at what number?
2
18. What are two concerns when acquiring data from a RAID server?
Amount of data storage needed, type of RAID server (0, 1, 5, and so on), whether the acquisition tool can handle RAID acquisitions, whether the analysis tool can handle RAID data, and whether the analysis tool can split RAID data into separate disk drives, making it easier to distribute large data sets
13. Describe what should be videotaped or sketched at a digital crime scene.
Computers, mobile devices, cable connections, overview of scene—anything that might be of interest to the investigation
Digital forensics and data recovery refer to the same activities. True or False?
False
4. What are the major improvements in the Linux Ext4 file system?
It added support for partitions larger than 16 TB, improved management of large files, and offered a more flexible approach to adding file system features.
7. What are the three rules for a forensic hash?
It can't be predicted, no two files can have the same hash value, and if the file changes, the hash value changes.
12. What does MFT stand for?
Master File Table
5. To determine the types of operating systems needed in your lab, list two sources of information you could use.
Uniform Crime Report statistics for your area and a list of cases handled in your area or at your company
13. In a Linux shell, the fdisk -l command lists the suspect drive as /dev/hda1. Is the following dcfldd command correct? dcfldd if=image_file.img of=/dev/hda1
Wrong. This command reads the image_file.img file and writes it to the evidence drive's /dev/hda1 partition. The correct command is dcfldd if=/dev/hda1 of=image_file.img.
12. If a suspect computer is running Windows 7, which of the following can you perform safely?
a. Browsing open applications
22. What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder?
c. The file is unencrypted automatically.
19. Virtual machines have which of the following limitations when running on a host computer?
c. Virtual machines are limited to the host computer's peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices.
10. When you arrive at the scene, why should you extract only those items you need to acquire evidence?
to minimize how much you have to keep track of at the scene
20. What do you call a list of people who have had physical possession of the evidence?
Chain of custody
16. List two hashing algorithms commonly used for forensics purposes.
MD5 and SHA-1
3. Explain how to identify an unknown graphics file format that your digital forensics tool doesn't recognize.
You need to examine a copy of the unknown file with a hexadecimal editor to find the hex code for the first several bytes of the file. Then you need to examine other known file types with similar or identical header values to see whether you can confirm its file type.
18. When validating the results of a forensics analysis, you should do which of the following? (Choose all that apply.)
a. Calculate the hash value with two different tools. b. Use a different tool to compare the results of evidence you find.
6. If a suspect computer is found in an area that might have toxic chemicals, you must do which of the following? (Choose all that apply.)
a. Coordinate with the HAZMAT team. c. Assume the suspect computer is contaminated.
19. With remote acquisitions, what problems should you be aware of? (Choose all that apply.)
a. Data transfer speeds b. Access permissions over the network c. Antivirus, antispyware, and firewall programs
21. EFS can encrypt which of the following?
a. Files, folders, and volumes
18. What methods do steganography programs use to hide data in graphics files? (Choose all that apply.)
a. Insertion b. Substitution
14. Which of the following techniques might be used in covert surveillance? (Choose all that apply.)
a. Keylogging b. Data sniffing
4. The manager of a digital forensics lab is responsible for which of the following? (Choose all that apply.)
a. Making necessary changes in lab procedures and software b. Ensuring that staff members have enough training to do the job c. Knowing the lab objectives
19. Some clues left on a drive that might indicate steganography include which of the following? (Choose all that apply.)
a. Multiple copies of a graphics file b. Graphics files with the same name but different file sizes c. Steganography programs in the suspect's All Programs list
6. The reconstruction function is needed for which of the following purposes? (Choose all that apply.)
a. Re-create a suspect drive to show what happened. b. Create a copy of a drive for other investigators. d. Re-create a drive compromised by malware.
6. Digital pictures use data compression to accomplish which of the following goals? (Choose all that apply.)
a. Save space on a hard drive. d. Produce a file that can be e-mailed or posted on the Internet.
2. According to ISO standard 27037, which of the following is an important factor in data acquisition? (Choose all that apply.)
a. The DEFR's competency c. Use of validated tools
4. Hashing, filtering, and file header analysis make up which function of computer forensics tools?
a. Validation and verification
4. As a corporate investigator, you can become an agent of law enforcement when which of the following happens? (Choose all that apply.)
a. You begin to take orders from a police detective without a warrant or subpoena. b. Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement.
15. Which of the following describes plist files? (Choose all that apply.)
a. You must have a special editor to view them. c. They're preference files for applications.
1. Sectors typically contain how many bytes?
b. 512
11. In Linux, which of the following is the home directory for the superuser?
b. root
6. How many sectors are typically in a cluster on a disk drive?
c. 4 or more
16. The standards for testing forensics tools are based on which criteria?
c. ISO 17025
3. To recover a password on a Mac system, which tool do you use?
c. Keychain Access
4. Areal density refers to which of the following?
c. Number of bits per square inch of a disk platter
8. In JPEG files, what's the starting offset position for the JFIF label?
c. Offset 6
4. What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data?
lossless
7. What does a logical acquisition collect for an investigation?
only specific files of interest to the case
17. What's the maximum file size when writing data to a FAT32 drive?
2 GB (a limitation of FAT file systems)
15. What is a hashing algorithm?
A program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk
11. What are the necessary components of a search warrant?
A search warrant must specify who, what, when, and where—that is, specifics on place, time, items being searched for, and so forth—and include any supporting materials (affidavits and exhibits, for example). In addition, a search warrant must be signed by an impartial judicial officer. In many cases, a search warrant can limit the scope of what can be seized.
17. Which organization has guidelines on how to operate a digital forensics lab?
ASCLD
3. What are two advantages and disadvantages of the raw format?
Advantages: faster data transfer speeds, ignores minor data errors, and most forensics analysis tools can read it. Disadvantages: requires equal or greater target disk space, doesn't contain hash values in the raw file (metadata), might have to run a separate hash program to validate raw format data, and might not collect marginal (bad) blocks.
11. List two features NTFS has that FAT does not.
Answers can include Unicode characters, security, and journaling.
18. List three items that should be in your case report.
Answers can include an explanation of basic computer and network processes, a narrative of what steps you took, a description of your findings, and log files generated from your analysis tools.
7. List three subfunctions of the extraction function.
Answers can include data viewing, keyword searching, decompressing, carving, decrypting, and bookmarking.
7. List three items stored in the FAT database.
Answers can include file and directory names, starting cluster numbers, file attributes, and date and time stamps.
9. List three items that should be in an initial-response field kit.
Answers can include small computer toolkit, large-capacity drive, IDE ribbon cables, forensic boot media, laptop IDE 40-to-44 pin adapter, laptop or portable computer, FireWire or USB dual write-protect external bay, flashlight, digital camera or 35mm camera, evidence log forms, notebook or dictation recorder, evidence bags (antistatic bags for digital devices), evidence labels, tape, tags, permanent ink marker, USB drives, or large portable hard drive
13. List three items that should be on an evidence custody form.
Answers include case number, name of the investigator assigned to the case, nature of the case, location where evidence was obtained, description of the evidence, and so on.
1. Explain the differences in resource and data forks used in the Mac OS.
Both contain a file's resource map and header information, window locations, and icons. The data fork stores a file's actual data, however, and the resource fork contains file metadata and application information.
5. How does the Mac OS reduce file fragmentation?
By using clumps, which are groups of contiguous allocation blocks
4. List two features common with proprietary format acquisition files.
Can compress or not compress the acquisition data; can segment acquisition output files into smaller volumes, allowing them to be archived to CD or DVD; case metadata can be added to the acquisition file, eliminating the need to keep track of any additional validation documentation or files.
23. What are the functions of a data run's field components in an MFT record?
Data runs have three components; the first declares how many bytes are required in the attribute field to store the number of bytes needed for the second and third components. The second component stores the number of clusters assigned to the data run, and the third component contains the starting cluster address value (the LCN or the VCN).
12. What are some ways to determine the resources needed for an investigation?
Determine the OS of the suspect computer and list the software needed for the examination.
22. Which forensics tools can connect to a suspect's remote computer and run surreptitiously?
EnCase Enterprise and ProDiscover Incident Response
6. Name two commercial tools that can make a forensic sector-by-sector duplicate of a drive to a larger drive.
EnCase, SafeBack, and SnapCopy
5. Of all the proprietary formats, which one is the unofficial standard?
Expert Witness, used by Guidance Software EnCase
3. The ASCLD mandates the procedures established for a digital forensics lab. True or False?
False
7. Under normal circumstances, a private-sector investigator is considered an agent of law enforcement. True or False?
False
21. Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or False?
False. All data collected before an attorney issues notice of attorney-client privilege is subject to discovery by opposing counsel.
5. Hardware acquisition tools typically have built-in software for data analysis. True or False?
False; most are used only for acquisition.
8. List two types of digital investigations typically conducted in a business environment.
Fraud, embezzlement, insider trading, espionage, and e-mail harassment
1. Forensic software tools are grouped into _________ and _______________ applications.
GUI, command line (or CLI)
7. List two popular certification systems for digital forensics.
IACIS, HTCN, EnCE, ISFCE
17. Device drivers contain what kind of information?
Instructions for the OS on how to interface with hardware devices
12. What's the advantage of a write-blocking device that connects to a computer through a FireWire or USB controller?
It enables you to remove and reconnect drives without having to shut down your workstation, which saves time in processing the evidence drive.
15. What's a virtual cluster number?
It represents the assigned clusters of files that are nonresident in the MFT. If a file has become fragmented, it can have two or more VCNs. The first VCN for a nonresident file is listed as 0.
10. What's the Disk Arbitration feature used for in Mac OS X?
It's used to disable and enable automatic mounting when a drive is connected via a USB or FireWire device.
16. Which organization provides good information on safe storage containers?
NISPOM
12. With newer Linux kernel distributions, what happens if you connect a hot-swappable device, such a USB thumb drive, containing evidence?
Newer Linux distributions automatically mount the USB device, which could alter data on it.
14. In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?
No data from RAM is copied to RAM slack on a disk drive.
21. What's the ProDiscover remote access utility?
PDServer
6. What items should your business plan include?
Physical security items, such as evidence lockers; how many machines are needed; what OSs your lab commonly examines; why you need certain software; and how your lab will benefit the company (such as being able to quickly exonerate employees or discover whether they're guilty).
20. How does ProDiscover Incident Response encrypt the connection between the examiner's and suspect's computers?
ProDiscover provides 256-bit AES or Twofish encryption with GUIDs and encrypts the password on the suspect's workstation.
9. What is professional conduct, and why is it important?
Professional conduct includes ethics, morals, and standards of behavior. It affects your credibility.
10. What three items should you research before enlisting in a certification program?
Requirements, cost, and acceptability in your chosen area of employment
6. List two items that should appear on a warning banner.
Statements that the organization has the right to monitor what users do, that their e-mail is not personal, and so on
18. What name refers to labs constructed to shield EMR emissions?
TEMPEST
9. In FAT32, a 123 KB file uses how many sectors?
The answer is 246 sectors. 123 x 1024 bytes per KB = 125,952 total bytes in the file. 125,952 bytes / 512 sectors per cluster = 246 sectors
8. What does the Ntuser.dat file contain?
This user-protected storage area contains the MRU files list and desktop configuration settings.
4. What's the purpose of maintaining a network of digital forensics specialists?
To develop a list of colleagues who specialize in areas different from your own specialties in case you need help on an investigation.
19. Why should you critique your case after it's finished?
To improve your work
14. Why should you do a standard risk assessment to prepare for an investigation?
To list problems that might happen when conducting an investigation, which can help in planning your case
8. Why is physical security so critical for digital forensics labs?
To maintain the chain of custody and prevent data from being lost, corrupted, or stolen
17. Why should evidence media be write-protected?
To make sure data isn't altered
16. Why was EFI boot firmware developed?
To provide better protection against malware than BIOS does
10. What's the purpose of an affidavit?
To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant
1. Corporate investigations are typically easier than law enforcement investigations for which of the following reasons?
a. Most companies keep inventory databases of all hardware and software used.
14. Hard links are associated with which of the following?
b. A specific inode
9. Hash values are used for which of the following purposes? (Choose all that apply.)
b. Filtering known good files from potentially suspicious data d. Validating that the original data hasn't changed
2. Police in the United States must use procedures that adhere to which of the following?
b. Fourth Amendment
20. What methods are used for digital watermarking?
b. Invisible modification of the LSBs in the file c. Layering visible symbols on top of the image
14. A JPEG file uses which type of compression?
b. Lossy
18. Which of the following Windows 8 files contains user-specific information?
b. Ntuser.dat
9. Which of the following describes the superblock's function in the Linux file system? (Choose all that apply.)
b. Specifies the disk geometry and available space c. Manages the file system, including configuration information
15. Which of the following is true of most drive-imaging tools? (Choose all that apply.)
b. They ensure that the original drive doesn't become corrupt and damage the digital evidence. c. They create a copy of the original drive.
17. Which of the following is true about JPEG and TIF files?
b. They have different values for the first 2 bytes of their file headers.
10. What is the space on a drive called when a file is deleted? (Choose all that apply.)
b. Unallocated space d. Free space
2. Which of the following is the main challenge in acquiring an image of a Mac system? (Choose all that apply.)
b. Vendor training is needed. d. You need special tools to remove drives from a Mac system or open its case. 3. To recover a password on a Mac system, which tool do you use?
11. The verification function does which of the following?
c. Proves that two sets of data are identical via hash values
2. When you carve a graphics file, recovering the image depends on which of the following skills?
c. Recognizing the pattern of the file header content
17. A log report in forensics tools does which of the following?
c. Records an investigator's actions in examining a case
12. Which of the following certifies when an OS meets UNIX requirements?
c. The Open Group
3. The triad of computing security includes which of the following?
c. Vulnerability/threat assessment, intrusion detection and incident response, and digital investigation
2. What does CHS stand for?
cylinders, heads, sectors
8. Which of the following Linux system files contains hashed passwords for the local system?
d. /etc/shadow
13. On most Linux systems, current user login information is in which of the following locations?
d. /var/log/utmp
2. Building a business case can involve which of the following?
d. All of the above
5. Policies can address rules for which of the following?
d. Any of the above
7. The process of converting raw images to another format is called which of the following?
d. Demosaicing
13. Bitmap (.bmp) files use which of the following types of compression?
d. Lossless
11. When you perform an acquisition at a remote location, what should you consider to prepare for this task?
determine whether there's enough electrical power and lighting and check the temperature and humidity at the location
1. Graphics files stored on a computer can't be recovered after they are deleted. True or False?
false
10. Copyright laws don't apply to Web sites. True or False?
false
10. In testing tools, the term "reproducible results" means that if you work in the same lab on the same machine, you generate the same results. True or False?
false
13. Building a forensic workstation is more expensive than purchasing one. True or False?
false
13. Digital forensics facilities always have windows. True or False?
false
14. Evidence storage containers should have several master keys. True or False?
false
15. A forensic workstation should always have a direct broadband connection to the Internet. True or False?
false
15. Only one file format can compress graphics files. True or False?
false
15. You should always prove the allegations made by the person who hired you. True or False?
false
16. A JPEG file is an example of a vector graphic. True or False?
false
17. Small companies rarely need investigators. True or False?
false
20. You should always answer questions from onlookers at a crime scene. True or False?
false
24. FTK Imager can acquire data in a drive's host protected area. True or False?
false
3. Zone bit recording is how manufacturers ensure that the outer tracks store as much data as possible. True or False?
false
5. The plain view doctrine in computer searches is well-established law. True or False?
false
5. When investigating graphics files, you should convert them into one standard format. True or False?
false
6. Linux is the only OS that has a kernel. True or False?
false
8. Data can't be written to disk with a command-line tool. True or False?
false
9. If a visitor to your digital forensics lab is a personal friend, it's not necessary to have him or her sign the visitor's log. True or False?
false
8. What does a sparse acquisition collect for an investigation?
fragments of unallocated data in addition to the logical allocated data
16. In the Linux dcfldd command, which three options are used for validating data?
hash, hashlog, and vf
19. You have been called to the scene of a fatal car crash where a laptop computer is still running. What type of field kit should you take with you?
initial-response field kit
1. What's the main goal of a static acquisition?
preservation of digital evidence
2. Name the three formats for digital forensics data acquisitions.
raw format, proprietary formats, and Advanced Forensic Format (AFF)
12. Typically, a(n) ____________ lab has a separate storage area or room for evidence.
regional
15. Commingling evidence means what in a corporate setting?
sensitive corporate information being mixed with data collected as evidence
9. What should you consider when determining which data acquisition method to use?
size of the source drive, whether the source drive is retained as evidence, how long the acquisition will take, and where the disk evidence is located
10. Why is it a good practice to make two images of a suspect drive in a critical investigation?
to ensure at least one good copy of the forensically collected data in case of any failures
1. An employer can be held liable for e-mail harassment. True or False?
true
11. Computer peripherals or attachments can contain DNA evidence. True or False?
true
11. When viewing a file header, you need to include hexadecimal information to view the image. True or False?
true
12. When recovering a file with ProDiscover, your first objective is to recover cluster values. True or False?
true
13. In NTFS, files smaller than 512 bytes are stored in the MFT. True or False?
true
14. A live acquisition is considered an accepted practice in digital forensics. True or False?
true
16. Data blocks contain actual files and directories and are linked directly to inodes. True or False?
true
16. For digital evidence, an evidence bag is typically made of antistatic material. True or False?
true
18. If a company doesn't distribute a computing use policy stating an employer's right to inspect employees' computers freely, including e-mail and Web use, employees have an expectation of privacy. True or False?
true
19. The primary hash the NSRL project uses is SHA-1. True or False?
true
2. In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a corporate investigator can conduct covert surveillance on an employee with little cause. True or False?
true
20. An image of a suspect drive can be loaded on a virtual machine. True or False?
true
3. If you discover a criminal act, such as murder or child pornography, while investigating a corporate policy abuse, the case becomes a criminal investigation and should be referred to law enforcement. True or False?
true
3. One reason to choose a logical acquisition is an encrypted drive. True or False?
true
9. Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files. True or False?
true
11. Large digital forensics labs should have at least ______ exits.
two
8. In forensic hashes, a collision occurs when ____________________.
two different files have the same hash value
14. What's the most critical aspect of digital evidence?
validation
