Chapter 14 - Info & Network Security
The Linux log file that contains activity related to the web server is ______.
/var/log/apaches/*
The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is ______________.
/var/log/apport.log
Ian is performing a forensic examination on a Linux server. He is trying to recover emails. Where does Linux store email server logs?
/var/log/mail.*
Which of the following are important to the investigator regarding logging? The logging methods Log retention Location of stored logs All of the above
All of the above
Mahmoud is using a range of Windows utilities to extract information from a computer he is triaging. He has just used the Openfiles command. The command Openfiles shows what?
Any shared files that are opened
In Windows, the log that stores events from a single application or component rather than events that might have system wide impact is the ____________ log.
Applications and services
Documentation of every person who had access to evidence, how they interacted with it, and where it was stored is called the ________________.
Chain of custody
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?
Chain of custody
_________ can include logs, portable storage, emails, tablets, and cell phones.
Computer evidence
"Interesting data" is what
Data relevant to your investigation
_______ is a free tool that can be used to recover Windows files.
Disk Digger
In Linux the command to set up a target forensics server to receive a copy of a drive is dd.
False
Most Windows logs are turned on automatically.
False
The Windows command fc lists all active sessions to the computer.
False
netstat is a command you can use with a forensic copy of a machine to compare two files.
False
You may use Linux to make a ______________ of the hard drive.
Forensically valid copy
In Windows the log that contains events collected from remote computers is the ____________ log.
Forwarded Events
Pedro is examining a Windows 7 computer. He has extracted the index.dat file and is examining that file. What is in the Index.dat file?
General Internet history, file browsing history, and so on for a Windows machine Internet Explorer information
Why should you note all cable connections for a computer you want to seize as evidence?
In case other devices were connected
If you fail to handle evidence properly ___________.
It may be unusable in court.
When cataloging digital evidence, the primary goal is to do what?
Preserve evidence integrity
Usually, the first thing you do to a computer to prevent further tampering is to _________.
Take it offline
Frequently the first responder to a computer crime is ________.
The network administrator.
Frequently the first responder to a computer crime is the network administrator.
True
Older versions of Internet Explorer stores web browsing information in a file called index.dat.
True
The Windows Registry contains a list of USB devices that have been connected to the machine.
True
The Windows Registry lists USB devices that have been connected to the machine.
True
The chain of custody accounts for the handling of evidence from the moment of seizure until it is presented in court, and documents that handling.
True
Windows logging can be turned on and off with a tool called auditpol.exe.
True
Using Linux to wipe the target drive, the command-line command would be ___ .
dd
What is the name of the Standard Linux command that is also available as a Windows application that can be used to create bitstream images and make a forensic copy?
dd
Windows stores information on web address, search queries, and recently opened files in a file called___________.
index.dat
Using Linux to backup your hard drive, if you want to create a hash, you would use the command-line command ___________.
md5sum
Using Linux to backup your hard drive, if you want to create a hash, you would use the command-line command ___________.
md5sum ------- THE SAME AS QUESTION #4
The Windows command to list any shared files that are currently open is ___________.
opennfiles