Digital forensic Quiz assessment
Forensic analysis should always be conducted on a copy of the original data. What type of copying is appropriate for getting data from life systems that cannot be taken off line?
A logical back up
Digital forensics is commonly applied to which of the following activities
All of the above
Which types of files are appropriate subjects for forensic analysis
All of the above
Which three of the following are application components?
Datafiles Authentication mechanisms Application architecture
NIST include which three as steps and collecting data?
Develop a plan to acquire the data Acquire the data Verify the integrity of the data
Which three of the following data types are considered non-volatile?
Dump files Logs Swap files
True or false: digital forensics report is a summary of your findings. If your case goes to trial, your testimony, Chan, and usually does, involve far more detail that is in the report.
False
True or false: when collecting forensic data from a running system, you should always attempt to collect nonvolatile data first
False
Which section of a digital forensics report would include using the best practices of taking lots of screenshots, use built in logging options of digital forensic tools, and exporting key data items into a CSV or TXT file?
Findings and analysis
The Internet layer of the TCP/IP stack also known as the networking layer in the OSI model contains two protocols that are very useful to a forensic investigation?
ICMP, IP V4/IP V6
Which of these sources might require a court order in order to obtain the data for forensic analysis?
ISP records
Configuration files are considered which data type?
Non-volatile
Which of these applications would likely be of the least interest in a forensic analysis?
Patch files
Which device would you inspect if you were looking for event data correlated across a number of different network devices?
Remote access server
Deleting a file results in what action by most operating systems?
The memory registers used by the file are marked as available for new storage, but are otherwise not changed
How does a forensic analysis use Hash sets acquired from and NIST's software reference library project?
They can quickly eliminate, known good operating system, and application files from consideration
What is the primary purpose of maintaining a chain of custody?
To avoid allegations of miss, handling or tampering of evidence
True or false: digital forensics has been used to solve a number of high profile, violent crimes
True