CIS 230 Final

In Virtual Box, a(n) ____ file contains settings for virtual hard drives.

.vbox

Which of the following file extensions are associated with VMware virtual machines?

.vmx, .log, and .nvram

Data acquisition is the process of copying data. How many different types of data acquisition are there?

2

Image files can be reduced by as much as ____% of the original.

50

A UNIX/Linux hard link is:

A pointer that allows accessing the same file by different filenames.

Which of these image file formats rarely compress their data or do so inefficiently?

BMP

Which of the following are not common computer forensics tools functions?

Command-line applications and GUI applications

The FBI formed this in 1984 to handle the increasing number of cases involving digital evidence.

Computer Analysis and Response Team (CART)

These records are data the system maintains, such as system log files and proxy server logs.

Computer-generated

In a MAC file system, a file consists of?

Data fork and resource fork.

This involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.

Data recovery

The process of converting raw images to another format is called which of the following?

Demosaicing

You can expect to find a type 2 hypervisor on what type of device?

Desktop

The most common and flexible data-acquisition method is ____.

Disk-to-image file copy

Which of these image file formats was developed by JEIDA as a standard for storing metadata in JPEG and TIFF files?

EXIF

Which of the following Linux file systems added support for partitions larger than 16TB?

Ext4

A forensic lab doesn't need to be physically secure as long as the forensic workstation is secured with a strong password.

False

Advanced hexadecimal editors cannot generate the hash value of selected data sets in a file or sector.

False

All forensic acquisition tools can copy data in the host protected area (HPA) of a disk drive.

False

An officer trained as a Digital Evidence First Responder (DEFR) has the skill to analyze the data and determine when another specialist should be called in to assist with the analysis.

False

Building a forensic workstation is more expensive than purchasing one.

False

Exculpatory evidence, in essence, is the same as inculpatory evidence, meaning it tends to clear the suspect.

False

Hardware acquisition tools typically have built-in software for data analysis

False

ISPs can investigate computer abuse committed by their customers.

False

In a NTFS file system, the backup copy of the Volume Boot Record (VBR) is stored in the third to last sector of the partition.

False

International Copyright laws apply to all Web sites in all countries.

False

Linux is the only OS that has a kernel.

False

Password recovery is included in all forensic tools.

False

Steganography determines ownership of media, such as images downloaded from a website, and the right to use media.

False

The Windows disk partition utility cannot change the disk partition table.

False

The law of search and seizure protects the rights of all people, excluding people suspected of crimes.

False

The unused space between partitions is called the unallocated gap.

False

Two files with different file names but exactly the same data content will have different hash values.

False

UNIX reduces file fragmentation by using clumps, which are groups of contiguous allocation blocks.

False

UNIX was created in the early 1990s to be a multiuser secure OS specifically for mobile phones.

False

Software forensic tools are grouped into which two applications?

GUI and Command-line applications

Which Registry key contains associations for file extensions?

HKEY_CLASSES_ROOT

Digital forensic tools are divided into which two major categories?

Hardware and software

The process of block-wise hashing can be best defined as:

Hashing of sectors to look for known file fragments.

Which best defines Order of Volatility (OOV)?

How long a piece of information lasts on a system.

This was created by police officers who wanted to formalize credentials in computing investigations.

IACIS

The standards for testing forensic tools are based on which criteria?

ISO 17025

Which of these compression methods permanently discards bits of information?

Lossy compression

Areal density refers to which of the following?

Number of bits per square inch of a disk platter

The first rule for all digital investigations is to:

Preserve the evidence

This is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.

Probable cause

The verification function does which of the following?

Proves that two sets of data are identical by calculating hash values

The verification function does which of the following?

Proves that two sets of data are identical via hash values

Which of the following is not a common graphic type:

QuickView

Which digital camera file format is referred to as a digital negative?

RAW

When you carve a graphics file, recovering the image depends on which of the following skills?

Recognizing the pattern of the file header content

A log report in forensic tools does which of the following?

Records an investigator's actions in examining a case

Scope Creep is defined as

Search of data where investigation expands beyond the original description because of unexpected evidence that has been found

Write-blockers protect evidence disks by preventing data from being written to them and can be divided into which two types?

Software and Hardware

Which of the following represents known files you can eliminate from an investigation?

System files the OS uses

Defense contractors during the Cold War were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. The U.S. Department of Defense calls this special computer-emission shielding ____.

TEMPEST

Which of the following is the main challenge in acquiring an image of a Mac OS?

The Mac design and engineering.

UNIX and Linux have four components defining the file system. They include:

The boot block, superblock, inode block, and data block.

The Federal Rules of Evidence (FRE), signed into law in 1973, was created for what purpose?

To ensure consistency in federal proceedings

A digital forensic lab is where you conduct investigations, store evidence, and do most of your work.

True

A forensic image of a VM includes all snapshots?

True

A live acquisition is considered an accepted practice in digital forensics.

True

A way of categorizing computer records is by dividing them into computer-generated records and computer-stored records.

True

Acquisition is the process of creating a duplicate image of data; one of the required functions of digital forensic tools.

True

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.

True

Digital Evidence can be ANY information stored or transmitted in digital form. Correct!

True

Digital forensic tools have some limitations in performing hashing, however, so using advanced hexadecimal editors is necessary to ensure data integrity.

True

Each type of graphics file has a unique header containing information that distinguishes it from other types of graphic files.

True

Forensics data acquisitions are stored in three formats, raw, proprietary, and AFF.

True

Law enforcement can confiscate anything an arrested person is carrying and log that device, such as a smartphone, was on the person, they don't necessarily have the right or authority to search the device.

True

Macintosh OS X uses the Intel Processor and is UNIX based. Correct!

True

Many password-protected OS's and applications store passwords in the form of MD5 or SHA hash values.

True

One advantage of using command-line tools for an investigation is that they require few system resources because they're designed to run in minimal configurations.

True

One reason to choose a logical acquisition is an encrypted drive.

True

The HFS and HFS+ file systems uses not one but two descriptors for the end of a file (EOF).

True

The plain view doctrine applies when investigators find evidentiary items that aren't specified in a warrant or under probable cause.

True

Validating digital evidence is the most critical aspect of computer forensics. Correct!

True

When attorneys challenge digital evidence, often they raise the issue of whether computer-generated records were altered or damaged after they were created.

True

Your professional conduct as a digital investigator is critical because it determines your credibility.

True

Virtual Machine "Hypervisors" can be divided into how many types:

Two

When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.

U.S. DoJ

What is the space on a drive called when a file is deleted?

Unallocated space

What is one of the most critical aspects of computer forensics?

Validating digital evidence

Which graphic type uses lines instead of dots to make up an image?

Vector

Which of the following is a clue that a virtual machine has been installed on a host system?

Virtual network adapter

During an investigation involving a live computer, do not cut electrical power to the running system unless it's an older ____ or MS-DOS system.

Windows XP

In a criminal or public case, if you have enough information to support a search warrant, the prosecuting attorney might direct you to submit this.

affidavit

This is the route the evidence takes from the time you find it until the case is closed or goes to court.

chain of custody

Confidential business data included with the criminal evidence are referred to as this kind of data.

commingled

For computer forensics, this is the task of collecting digital evidence from electronic media.

data acquisition

To conduct your investigation and analysis, you must have a specially configured personal computer (PC) known as this.

forensic workstation

Courts consider evidence data in a computer as ____ evidence.

physical

Evidence is commonly lost or corrupted through this, which involves police officers and other professionals who aren't part of the crime scene processing team.

professional curiosity

In general, a criminal case follows three stages: the complaint, the investigation, and this.

prosecution

Without a warning banner, employees might have an assumed ____ when using a company's computer systems and network accesses.

right of privacy

Environmental and ____ issues are your primary concerns when you're working at the scene to gather information about an incident or a crime.

safety

Real-time surveillance requires ____ data transmissions between a suspect's computer and a network server.

sniffing

Microsoft has added ____ with BitLocker to its newer operating systems, such as Windows 8 and 10, which makes performing static acquisitions more difficult.

whole disk encryption