Digital forensics review

Réussis tes devoirs et examens dès maintenant avec Quizwiz!

What hexadecimal code below identifies an NTFS file system in the partition table?​

07

You will need a minimum of _____ GHz or faster CPU to run VMWorkstation on a computer.

1.3GHz

​In order to qualify for the Certified Computer Forensic Technician, Basic Level certification, how many hours of computer forensics training are required?

40

​A typical disk drive stores how many bytes in a single sector?

512

Certified Forensic Computer Examiner (CFCE)

A certificate awarded by IACIS at completion of all portions of the exam

Certified Cyber Forensics Professional (CCFP)

A certification from ISC2 for completing the education and work experience and passing the exam

Certified Computer Examiner (CCE)

A certification from the International Society of Forensic Computer Examiners

Business case

A document that provides justification to upper management or a lender for purchasing new equipment, software, or other tools when upgrading your facility

Secure facility

A facility that can be locked and allows limited access to the room's contents

Digital forensics lab

A lab dedicated to computing investigations; typically, it has a variety of computers, OSs, and forensics software

​Cyclic Redundancy Check

A mathematic algorithm that translates a file into a unique hexadecimal value

High Tech Crime Network (HTCN)

A national organization that provides certification for computer crime investigators and digital forensics technicians

Initial-response field kit

A portable kit containing only the minimum ​tools needed to perform disk acquisitions and preliminary forensics analysis in the field

TEMPEST

A term referring to facilities that have been hardened so that electrical signals from computers, the computer network, and telephone systems can't be monitored or accessed easily by someone outside the facility

Keyed hash set​

A value created by an encryption utility's secret key​

_______ describes an accusation of fact that a crime has been committed.

Allegation

Sniffing

Detecting data transmissions to and from a suspect's computer​ and a network server to determine the type of data being transmitted over a network

​Computer-stored records

Electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word-processing document

A computer stores system configuration and date and time information in the BIOS when power to the system is off.​

False

A hash value is always represented by a 16 digit number which is unique to the data.

False

All suspected industrial espionage cases should be treated as civil case investigations.​

False

Each MFT record starts with a header identifying it as a resident or nonresident attribute.​

False

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.​

False

Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.

False

The Fourth Amendment states that only warrants "particularly describing the place to be searched and the persons ​or things to be seized" can be issued. The courts have determined that this phrase means a warrant can authorize a search of a specific place for ​anything.​

False

The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. Department of Defense.​

False

VMware provides software virtualization that presents a platform to the virtual machine.

False

​According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

False

Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.

Federal Rule of Evidence

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?​

Fourth Amendment

A Virtual machine connects to external networking via IP address use by the host machine and is useful when you - (select all that apply).

Have resources that must be shared with host. Have limited supply of IP addresses. Want to hide private IP subnet.

Which Microsoft OS below is the least intrusive to disks in terms of changing data?​

MS_DOS 6.22

Which operating system listed below is not a distribution of the Linux OS?

Minix

Which of the following are unique to VMworkstation.

Networking Clones Record/Replay Teams

Which of the following are key properties of virtual machines? (select all that apply).

Partitioning Encapsulation Isolation

_______ is not recommended for a digital forensics workstation.

Remote Access Software

Bit-stream image

The file where the bit-stream copy is stored

Risk management

The process of determining how much risk is acceptable for any process or operation, such as replacing equipment

Configuration management

The process of keeping track of all upgrades and patches you apply to your computer's OS and applications

​Probable cause

The standard specifying whether a police officer has the right to make an arrest, conduct a personal or property search, or obtain a warrant for arrest

A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.

True

An additional benefit of using a Restricted Virtual Machine is that it requires a password to edit information within the virtual machine.

True

An emergency situation under the PATRIOT Act is defined as the immediate risk of death or personal ​injury, such as finding a bomb threat in an e-mail.

True

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.​

True

Linux Live CDs and WinFE disks do not automatically mount hard drives, but can be used to view file systems.​

True

Most digital investigations in the private sector involve misuse of computing assets.

True

One benefit of using VMware is that it offers the benefit of realizing significant cost savings.

True

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.​

True

The maximum number of Virtual Switches that can be be created is 10 on a Windows machine and 255 on a Linux machine.

True

To investigate employees suspected of improper use of company digital assets, a company policy statement about misuse of digital assets allows corporate investigators to conduct covert surveillance with little or no cause, and access company computer systems and digital devices without a warrant.​

True

User groups for a specific type of system can be very useful in a forensics investigation.​

True

Virtualization enables consolidation of workloads from underutilized servers onto a single server

True

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.​

True

​The recording of all updates made to a workstation or machine is referred to as configuration management.

True

Virtual Provisioning is a strategy for efficiently managing space in a storage area network and does all of the following except for:

Virtual provisioning has a downside and can consume a large amount of power which can slightly increase costs.

Which of the following is not part of virtualization?

Virtualization is a platform that is based on the iOS operating system.

​The _______ is not one of the three stages of a typical criminal case.

civil suit

Which of the following scenarios should be covered in a disaster recovery plan?​

damage caused by lightning strikes ​damage caused by flood ​damage caused by a virus contamination

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

one

The term _______ is used to describe someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.

person of interest

​After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

verdict

How long are computing components designed to last in a normal business environment?​

​18 to 36 months

In what year was the Computer Fraud and Abuse Act passed?​

​1986

​Extensive-response field kit

​A portable kit designed to process several computers and a variety of operating systems at a crime or incident scene involving computers

​Nonkeyed hash set

​A unique hash number generated by a software tool and used to identify files

​Message Digest 5

​An algorithm that produces a hexadecimal value of a file or storage media; used to determine whether data has changed

Which system below can be used to quickly and accurately match fingerprints in a database?​

​Automated Fingerprint Identification System (AFIS)

​What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?

​Certified Cyber Forensics Professional

​Candidates who complete the IACIS test successfully are designated as a _______.

​Certified Forensic Computer Examiner (CFCE)

What type of media has a 30-year lifespan?​

​DLT magnetic tape

_______ is not one of the functions of the investigations triad.

​Data recovery

​Computer-generated records

​Data the system maintains, such as system log files and proxy server logs

​After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

​Digital Evidence First Responder

The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.

​Digital Evidence Specialist

_______ must be included in an affidavit to support an allegation in order to justify a warrant.

​Exhibits

​What does FRE stand for?

​Federal Rules of Evidence

You must abide by the _______ while collecting evidence.

​Fourth Amendment

In cases that involve dangerous settings, what kind of team should be used to recover evidence from the scene?​

​HAZMAT

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?​

​ILook

_______ is a specialized viewer software program.

​IrfanView

What should you do while copying data on a suspect's computer that is still live?​

​Make notes regarding everything you do.

_______ can be used to restore backup files directly to a workstation.

​Norton Ghost

_______ is a common cause for lost or corrupted evidence.

​Professional curiosity

Which of the following is not done when preparing for a case?​

​Set up covert surveillance.

Which option below is not a standard systems analysis step?​

​Share evidence with experts outside of the investigation.

_______ does not recover data in free or slack space.

​Sparse acquisition

_______ is responsible for creating and monitoring lab policies for staff, and provides a safe and secure workplace for staff and evidence.​

​The lab manager

When seizing digital evidence in criminal investigations, whose standards should be followed?​

​U.S. DOJ

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?​

​United States v. Salgado

Which tool below is not recommended for use in a forensics lab?​

​Use a master key.

_______ is a specialized viewer software program.

​Use a master key.

​An evidence custody form does not usually contain _______.

​a witness list

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.​

​affidavit

A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.

​evidence custody form

A _______ is not ​a private sector organization.

​hospital

The sale of sensitive or confidential company information to a competitor is known as _______.

​industrial espionage

The term _______ describes a database containing informational records about crimes that have been committed previously by a criminal.

​police blotter

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.​

​probable cause

​Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

​repeatable findings


Ensembles d'études connexes

Chapter 46. Holistic Healing, Funds II Chapter 46. Holistic Healing, Pharmacology: Hypertension, Davis Edge Medication Patients (Chp 25), Pain and CAM, Pharmacology Exam 1 Review Questions, Chapter 25: Pharmacology Quiz, Pharmacology Chapter 25, Phar...

View Set