Chapter 14
Older versions of Internet Explorer stores web browsing information in a file called index.dat. True or False
True
The Windows Registry contains a list of USB devices that have been connected to the machine. True or False
True
The Windows Registry lists USB devices that have been connected to the machine. True or False
True
The chain of custody accounts for the handling of evidence from the moment of seizure until it is presented in court, and documents that handling. True or False
True
Windows logging can be turned on and off with a tool called auditpol.exe. True or False
True
Mahmoud is using a range of Windows utilities to extract information from a computer he is triaging. He has just used the Openfiles command. The command Openfiles shows what? a. Any shared files that are opened b. Any files that are opened c. Any files open with ADS d. Any system files that are opened
a. Any shared files that are opened
In Linux the command to set up a target forensics server to receive a copy of a drive is dd. True or False
False
Most Windows logs are turned on automatically. True or False
False
The Windows command fc lists all active sessions to the computer. True or False
False
netstat is a command you can use with a forensic copy of a machine to compare two files. True or False
False
Frequently the first responder to a computer crime is the network administrator. True or False
True
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court? a. Chain of custody b. Policy of separation c. Rules of evidence d. Law of probability
a. Chain of custody
In Windows the log that contains events collected from remote computers is the ____________ log. a. Forwarded Events b. Application c. Applications and services d. System
a. Forwarded Events
Pedro is examining a Windows 7 computer. He has extracted the index.dat file and is examining that file. What is in the Index.dat file? a. General Internet history, file browsing history, and so on for a Windows machine b. All web history for Firefox c. General Internet history, file browsing history, and so on for a Linux machine d. Internet Explorer information
a. General Internet history, file browsing history, and so on for a Windows machine
Why should you note all cable connections for a computer you want to seize as evidence? a. In case other devices were connected b. To know what peripheral devices exist c. To know what outside connections existed d. To know what hardware existed
a. In case other devices were connected
If you fail to handle evidence properly ___________. a. It may be unusable in court. b. You will be part of crime. c. Law enforcement may not look at it. d. You may damage the hard drive.
a. It may be unusable in court.
Usually, the first thing you do to a computer to prevent further tampering is to _________. a. Take it offline b. Lock it in a secure room. c. Make a copy d. Make a backup
a. Take it offline
What is the name of the Standard Linux command that is also available as a Windows application that can be used to create bitstream images and make a forensic copy? a. dd b. MD5 c. mcopy d. image
a. dd
Using Linux to backup your hard drive, if you want to create a hash, you would use the command-line command ___________. a. md5sum b. nd c. dd d. cc
a. md5sum
Ian is performing a forensic examination on a Linux server. He is trying to recover emails. Where does Linux store email server logs? a. /etc/log/mail.* b. /var/log/mail.* c. /mail/log/mail.* d. /server/log/mail.*
b. /var/log/mail.*
_______ is a free tool that can be used to recover Windows files. a. Outlook b. Disk Digger c. FileRecover d. SearchIt
b. Disk Digger
In Windows, the log that stores events from a single application or component rather than events that might have system wide impact is the ____________ log. a. ForwardedEvents b. System c. Applications and services d. Application
c. Applications and services
Documentation of every person who had access to evidence, how they interacted with it, and where it was stored is called the ________________. a. Hiking trail b. Audit trail c. Chain of custody d. Forensic trail
c. Chain of custody
"Interesting data" is what a. Pornography b. Documents, spreadsheets, and databases c. Data relevant to your investigation d. Schematics or other economic-based information
c. Data relevant to your investigation
You may use Linux to make a ______________ of the hard drive. a. New version b. Screen shot c. Forensically valid copy d. Bootable copy
c. Forensically valid copy
Using Linux to wipe the target drive, the command-line command would be ___ . a. cc b. nd c. dd d. md5sum
c. dd
Windows stores information on web address, search queries, and recently opened files in a file called___________. a. internet.txt b. default.dat c. index.dat d. explore.exe
c. index.dat
The Windows command to list any shared files that are currently open is ___________. a. fc b. ping c. opennfiles d. netstat
c. opennfiles
The Linux log file that contains activity related to the web server is ______. a. /var/log/kern.log b. /var/log/apport.log c. /var/log/lighttpd/* d. /var/log/apaches/*
d. /var/log/apaches/*
The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is ______________. a. /var/log/kern.log b. /var/log/lighttpd/* c. /var/log/apache2/* d. /var/log/apport.log
d. /var/log/apport.log
Which of the following are important to the investigator regarding logging? a. The logging methods b. Log retention c. Location of stored logs d. All of the above
d. All of the above
_________ can include logs, portable storage, emails, tablets, and cell phones a. Security kit b. Network devices c. Ancillary hardware d. Computer evidence
d. Computer evidence
When cataloging digital evidence, the primary goal is to do what? a. Prohibit the computer from being turned off b. Avoid removing the evidence from the scene c. Make bitstream images of all hard drives. d. Preserve evidence integrity
d. Preserve evidence integrity
Frequently the first responder to a computer crime is ________. a. A law enforcement officer b. The news media c. College students d. The network administrator.
d. The network administrator.