ITP 375 Quizlet

In EnCase, if you have a file with a JPEG Extension but is really a rich text file (RTF), what will be filed in the file signature column

* Rich Text

Digital Evidence

Any information of probative value stored or transmitted in digital form.

Internal Investigation

Any type of investigation handled internally to an organization, prior to filing a formal report with law enforcement or court systems

Forensic Process: 6 A's

Assessment, acquisition, authentication, analysis, articulation, archival

How do we handle evidence?

Authentication of evidence, chain of custody, evidence validation

Computer: Contraband

Digital equipment, media, or data illegally obtained

Computer: Incidental to the Crime

Digital media is a storage repository of evidence of a crime

Recycle Bin

Everytime a file is deleted into the recycle bin, two files are created, both with same characters but preceded with either a $R or $I. $R is the actual deleted file, $I is the metadata.

RAW Duplicate

Exact binary copy from one disk onto another disk --> fastest way to make a copy. The drawback is that you must use a write blocker on copy at all times. You must verify copy has not been altered and must treat the entire disk as evidence

Master Boot Record

Limited to 4 physical partitions, info at the beginning of the disk at the first physical sector (sector 0)

Metadata vs Data

Metadata is "data about data," otherwise info that is useful or necessary for file system to organize the data. Completely independent of the stored data for file, and dependent on type of file system used. Data is the actual file contents in binary hex form

Cluster

Minimum file size for allocating data --> always 4KB

Forensic Process: Archival

Storage of the forensic media, notes, and report

Best Evidence

Most complete copy of evidence that was obtained that is most closely linked to original evidence. If the original drive is in possession, then that is the best evidence along with the original evidence

Full Format

Theoretically wipes the partition --> doesn't always though

True or false: A volume must have a configured file system

True

FTK Imager computers which hash numbers for a forensic image?

MD5 and SHA1

Forensic Process: Acquisition

Make your forensic duplicate of all digital media and making sure your tools used are designed/approved for forensics

Linux File Systems

Many different file systems, will talk about Ext2, Ext3, and Ext4. They implement Inodes

Which registry key contains an entry for the drive letter recently assigned to a flash drive?

MountedDevices

Which of the following is an invalid regular expression for finding USC email addresses? @usc.edu [a-zA-Z][a-zA-Z\-\.\_]+@usc\.edu [a-zA-Z\-\.\_]+@usc\.edu +@usc\.edu

@usc.edu

Working Copy of Evidence

A copy to work on that are not tracked by evidence custodians, especially in case anything goes wrong and you alter the data on the working copy

Write-Blockers

A device that stops the host system from sending a write signal to any connected drive

FAT Directory Entries

A file which contain a listing of the contents of a directory of a directory (file name, extension, attribute flags, creation date/time, last accessed, last written/modified, starting cluster

File Systems

A way of organizing the data on a disk, containing some abstract structure to map files to allocation units on a disk

A non-unique serial number will have which character as the second character of the number?

An ampersand (&)

Evidence Image Files (Bit-Stream Image)

Bit-for-bit duplicate otherwise known as a RAW duplicate (exact binary copy from one disk onto another). Can be stored as a RAW binary on a duplicate disk, or as a file on a destination disk (DD image, EnCase Image File E01).

Encase Image File

Bitstream separated into 32K of data (64 sectors) called chunks. Every 32K chunk has a 4-byte CRC checksum which is verified against the data every time file is opened. Allows for compression and encryption of data. Pros are single bit changes can be isolated to a 32k set of data, allowing rest of data to be pseudo-verified. Cons are that it is slower to create.

FAT Directory Table

Keeps track of all files contained in the directory. When a file is deleted, that entry is simply marked as "deleted" in the table. Undeleting a file in FAT means going through the directory table, following the cluster chain, and seeing if clusters have appropriate data

Inode

Like a pointer in programming which points to a block on the disk, pointing to actual stored data or a new table of inodes which point to indirect blocks. FIles in Unix and Linux are pointers to Inodes

Windows 7 AppData

Local: Application data specific to a computer. LocalLow: Supposed to be for internet browsers, but no one really uses it. Roaming: Application data that can move with a user account across a domain.

Internet History

A chronology of sites visited by a user.

Quick Format

Only writes the new file system information onto the partition

Volume

Partition with a single file system configured

Digital Media

Physical object(s) on which digital data can be stored

Hard Drive - Sectors

Pie-shaped wedges of tracks, 512 bytes for magnetic media (new hard drives have 4096 byte sectors). Smallest unit of data that can be read or written from magnetic storage media

Forensic Process: Analysis

Processing of the forensic duplicate, looking for evidence to support the case

Cookies

Saved information on a user's system for internet servers to track user information, such as shopping carts and session tokens

All USB Devices have registry entries in the USB Registry Key

True

File Extensions

Used by humans and operating system to identify the file type and program to open the file

Optical Media

Usually CD-ROM, DVD, Blu Ray. Uses a reflective surface as the digital storage medium. Writing data must be done to the entire disc at once, and thus inherently is read-only and does not need a write blocker

Magnetic Media

Usually floppy disks and hard disks. A magnetized medium holds a series of charges either positive or negative. Pros: Very large storage capabilities, data can be overwritten without being reset infinitely, fast sequential reads. Cons: Very slow access times, very slow random read/write, data must be reorganized to be sequential (defragmentation)

Flash Media

Usually solid state drives.

Bookmarks

Webpages marked as favorite for quick navigation

Unallocated Space

When a file is deleted in Windows, the clusters that contain the file do not get wiped. They get grouped into space available for file allocation, called "unallocated space". Undeleting files is going through unallocated space and trying to find actual files or file fragments.

Windows Pagefile

When your computer does not have enough memory to store all of the data from the applications you have open, it uses a swap file, otherwise a file on the computer for storing temporary memory --> pagefile.sys. Hit or miss, great for finding emails!

Which of the following descriptor fields is not required for a USB flash drive? iSerialNumber idProduct bcdDevice idVendor

iSerialNumber

Little Endian

Data held in primary memory are arranged in two bits that put the right most bit in the earliest memory positions.

Golden Rules of Digital Forensics

1. Protect and preserve the evidence. 2. Always assume the case is going to court.

Acquisition methodology

Demonstrating that your actions had as little impact on the evidence as possible

Which of the following file types does not have a file header?

Text (TXT)

In NTFS, where is the file metadata located?

The MFT

In FAT, where is the file metadata stored?

The directory entry

How is evidence admissible and relevant?

The judge determines what evidence is or is not admissible based on rules of evidence. Evidence is relevant if it has any tendency to make a fact more or less probable than it would be without the evidence and the fact is of consequence in determining the action.

Which of the following is not a registry hive in Windows 7? CONFIG SAM SOFTWARE

CONFIG

Recovering Partitions

Can recover a deleted partition by looking for the volume boot record, otherwise the first sector of the partition containing the boot instructions for loading the partition

Printer Spool Files

Contains information about printing items, such as shadow file that contains info about print job or spool file that contains actual file to print

How are computers used in crimes?

Contraband, tool for the crime, incidental to the crime

Volume Boot Record

Created at the first sector of the partition containing the partition and volume information, including file system type and other metadata about volume. When you format a disk, you are writing a file system onto a partition, turning it into a volume

Big Endian

Data held in primary memory are arranged in two bits that put the left most bit in the earliest memory positions.

Forensic Process: Articulation

Drafting and submitting your report

What evidence file contains CRC checksum of every 32 KB of data to identify which 32 KB of data has become corrupted in the event of a hash verification failure?

E01 File

If I had the following Hex number -- 85 13 3F EE -- how would it be written in memory in little-endian?

EE 5F 13 85

Forensic Process: Authentication

Ensure that any duplicates made during acquisition phase are verified to be perfect duplicates--> using hashes to ensure original media and duplicate are the same

FAT File System

FAT: File Allocation Table. Uses a construct called file allocation table which keeps track of clusters that are free for use, occupied, and linked to another cluster. Stores information in directory entries.

Which of the following is not a tool in Kali linux to create a forensic image file?

FTK Imager

True or False: By default, EnCase's built-in GREP expressions for credit cards eliminate most false positives.

False

True or false: A flash drive without a unique serial number will not have an entry in the USBSTOR registry hive

False

True or false: A partition must have a configured file system.

False

True or false: All email header server list is read from top to bottom, sender to receiver.

False

Forensic Process: Assessment

Gathering information about the case. 1. Determine your scope 2. Identify digital media 3. Mark and protect the media 4. Establish chain of custody

Which of the following is not a root registry key? HKEY_SYSTEM HKEY_LOCAL_MACHINE HKEY_CURRENT_CONFIG HKEY_CURRENT_USER

HKEY_SYSTEM

Computer: Tool(s) of the crime

Hacking cases

NTFS (New Technology File System)

Has a master file table (MFT) that is used for metadata and file allocation. Stores filename, attribute, date/times, as well as clusters allocated to that particular file. Uses a file called bitmap to store available cluster information. Just like FAT, when a file is deleted, it is marked deleted and can be unmarked.

Evidence Disposal

Initial disposal: working copies are returned to evidence custodian, who wipes them clean. Final disposal: all backups and best evidence can be wiped after a period of time

Civil Investigation

Investigation of a civil case: lawsuit between private entities, usually involving private property rights

Criminal Investigation

Investigation of a criminal case: lawsuit brought by a prosecutor employed by the government that charges a person with the commission of a crime

Partition

Set of consecutive sectors on a disk

LNK Files

Shortcuts, found everywhere but especially recent folder.

File Signatures or Headers

Some form of unique identifier in the beginning of the data identifying to a program the way that the data is encoded --> part of the data, not the metadata

Slack Space

Space between logical end of the file and actual end of the file. Hard disk is broken down into clusters (8 sectors, 4KB)

Daubert Standard

Standard used by a trial judge to make a preliminary assessment of whether the expert's scientific testimony is based on reasoning or methodology that is scientifically valid

DD Image File

Takes binary information from the source and writes it into a file on the destination. Contains exact binary of the evidence disk, but can be encapsulated on a file. Pros are that everything can read a DD file, it's fairly fast to create, and can be segmented. Cons are there are no way to detect changes without reverification, metadata is not stored, and changes to DD file will result in a verification failure.

Internet Cache

The saved HTML webpages and image assets to allow for quick webpage loading by the browser