CIS 282 Fall 2022 - Final Studyguide
What term refers to the number of bits in one square inch of a disk platter?
Areal density
Where do phones typically store system data? A.) ROM B.) EEPROM C.) EROM D.) PROM
EEPROM
In which format are most digital photographs stored?
EXIF
Which term is often used when discussing Linux because technically, Linux is only the core of the OS?
Kernel
Which agency introduced training on software for forensics investigations by the early 1990s?
IACIS
Remote acquisitions are often easier because you're usually dealing with large volumes of data.
False
Requirements for taking the EnCE certification exam depend on taking the Guidance Software EnCase training courses. A.) True B.) False
False
At what levels should lab costs be broken down?
Monthly, quarterly, and annually
Which motion provides a written list of objections to certain testimony or exhibits?
Motion in limine
What organization was created by police officers in order to formalize credentials for digital investigators?
IACIS
ow do most manufacturers deal with a platter's inner tracks having a smaller circumference than its outer tracks?
ZBR
In macOS, in addition to allocation blocks, what kind of blocks do volumes have?
Logical blocks
In older versions of macOS, in which fork are file metadata and application information stored?
Resource
In which cloud service level are applications delivered via the Internet?
Software as a service
As an expert witness, you have opinions about what you have found or observed. A.) True B.) False
True
Bitmap images are collections of dots, or pixels, in a grid format that form a graphic.
True
By the 1970s, electronic crimes were increasing, especially in the financial sector. A.) True B.) False
True
Computers used several OSs before Windows and MS-DOS dominated the market. A.) True B.) False
True
Experts should be paid in full for all previous work and for the anticipated time required for testimony.
True
Which program can be used to examine network traffic? A.) tcpdump B.) netdump C.) slackdump D.) coredump
tcpdump
The Enhanced Data GSM Environment (EDGE) standard was developed specifically for which type of service? A.) OFDM B.) CDMA C.) D-AMPS D.) 3G
3G
Which organization has stated that, unlike attorneys, expert witnesses do not owe a duty of loyalty to their clients?
ABA
Which document offers comprehensive guidance for psychologists, with an entire section devoted to forensics activities?
APA's Ethics Code
Which images store graphics information as grids of pixels?
Bitmap
When federal courts are evaluating digital evidence from computer-generated records, what exception is applied to hearsay? A.) Computer-generated records exception B.) Best-evidence rule exception C.) Business-records exception D.) Digital-records authenticity exception
Business-records exception
What technology, developed during WWII, uses the full radio spectrum to define channels and is now used in the U.S. by Sprint, U.S. Cellular, and Verizon?
CDMA
As data is added, the MFT can expand to take up 75% of the NTFS disk. A.) True B.) False
False
Autopsy for Windows cannot perform forensics analysis on FAT file systems. A.) True B.) False
False
Computer investigations and forensics fall into the same category: public investigations. A.) True B.) False
False
Corporate investigators always have the authority to seize all computer equipment during a corporate investigation. A.) True B.) False
False
E-mail crimes and violations rarely depend on the city, state, and country in which the e-mail originated.
False
Expert opinions cannot be presented without stating the underlying factual basis.
False
ISPs can investigate computer abuse committed by their customers.
False
If damage occurs to the floor, walls, ceilings, or furniture on your computer forensics lab, it does not need to be repaired immediately. A.) True B.) False
False
If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available.
False
If you must write a preliminary report, use words such as "preliminary copy," "draft copy," or "working draft."
False
In software acquisition, there are three types of data-copying methods. A.) True B.) False
False
Investigating crimes or policy violations involving e-mail is different than investigating other types of computer abuse and crimes.
False
Investigating smartphones and other mobile devices is a relatively easy task in digital forensics. A.) True B.) False
False
Most basic phones use the same OSs as PCs. A.) True B.) False
False
Network forensics is a fast, easy process. A.) True B.) False
False
Operating systems do not have tools for recovering image files. A.) True B.) False
False
Steganography cannot be used with file formats other than image files.
False
The first 5 bytes (characters) for all MFT records are FILE.
False
The law of search and seizure protects the rights of all people, excluding people suspected of crimes.
False
The law requires search warrants to contain specific descriptions of what's to be seized. For cloud environments, the property to be seized usually describes physical hardware rather than data, unless the CSP is a suspect. A.) True B.) False
False
Unlike RAID 0, RAID 3 stripes tracks across all disks that make up one volume. A.) True B.) False
False
When intruders break into a network, they rarely leave a trail behind. A.) True B.) False
False
When two files look the same when viewed but one has an invisible digital watermark, they appear to be the same file except for their sizes.
False
Windows OSs do not have a kernel.
False
You should create a formal checklist of your procedures that's applied to all your cases or include such a checklist in your report.
False
macOS is built with the new Apple File System (APFS). The current version offers better security, encryption, and performance speeds, but users can't mount HFS+ drives.
False
Which activity involves sorting and searching through investigation findings to separate good data and suspicious data? A.) Filtering B.) Acquisition C.) Reconstruction D.) Validation
Filtering
Which tool enables the investigator to acquire the forensic image and process it in the same step?
Magnet AXIOM
What does scope creep typically do?
Increases the time and resources needed to extract, analyze, and present data
Which is the most accurate statement about investigating and controlling computer incident scenes in private-sector environments as compared to crime scenes? A.) Investigating and controlling the scene is more difficult in private sector environments. B.) Investigating and controlling the scene is equally difficult in both environments. C.) Investigating and controlling the scene is equally easy in both environments. D.) Investigating and controlling the scene is much easier in private sector environments.
Investigating and controlling the scene is much easier in private sector environments.
What type of cards, consisting of a microprocessor and internal memory, are usually found in GSM devices?
SIM
With cloud systems running in a virtual environment, what can be used to give the investigator valuable information before, during, and after an incident?
Snapshots
What type of acquisition is typically done on a computer seized during a police raid? A.) Static B.) Real-Time C.) Live D.) Online
Static
In addition to search warrants, what defines the scope of civil and criminal cases?
Subpoenas
Which digital forensics tool is categorized as a single-purpose hardware component?
Tableau T35es-R2 SATA/IDE eSATA bridge
Which standard states that, to provide reliable and valid testimony, the expert has the "ethical responsibility to present a complete and unbiased picture of the . . . research relevant to the case at hand?" A.) The APA standard B.) The ABA standard C.) The IACIS standard D.) The Daubert standard
The Daubert standard
Suppose you have been hired to determine whether a corrupted file was intentionally altered or altered by a virus. Your forensic examination did not find evidence of a virus and did not find evidence of intentional alteration. What conclusion can you offer? A.) The cause of the file's corruption is unknown. B.) The file was corrupted by a software malfunction. C.) The file was accidentally corrupted. D.) The file was corrupted by unknown malware.
The cause of the file's corruption is unknown.
At what location does the forensics investigator conduct investigations, store evidence, and do most of his or her work?
The digital forensics lab
Many people store more information on smartphones and tablets than on computers.
True
One way to examine a partition's physical level is to use a disk editor, such as WinHex, or Hex Workshop. A.) True B.) False
True
Part of what you have to deliver to the jury is a person they can trust to help them figure out something that's beyond their expertise.
True
People need ethics to help maintain their balance, especially in difficult and contentious situations. A.) True B.) False
True
Portability of information is what makes SIM cards so versatile.
True
Several password-cracking tools are available for handling password-protected data or systems. A.) True B.) False
True
Some acquisition tools don't copy data in the host protected area (HPA) of a disk drive.
True
Some notable UNIX distributions included Silicon Graphics, Inc. (SGI) IRIX, Santa Cruz Operation (SCO) UnixWare, Sun Solaris, IBM AIX, and HP-UX A.) True B.) False
True
Specially trained system and network administrators are often a CSP's first responders.
True
The Internet is the successor to the Advanced Research Projects Agency Network (ARPANET).
True
The chain of custody of evidence supports the integrity of your evidence.
True
The defense request for full discovery of digital evidence applies only to criminal cases in the United States.
True
The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your disk-to-image file. A.) True B.) False
True
The pipe (|) character redirects the output of the command preceding it.
True
The reason for the standard practice of securing an incident or crime scene is to expand the area of control beyond the scene's immediate location. A.) True B.) False
True
The type of file system an OS uses determines how data is stored on the disk. A.) True B.) False
True
To be a successful computer forensics investigator, you must be familiar with more than one computing platform.
True
To help determine which computer forensics tool to purchase, a comparison table of functions, subfunctions, and vendor products is useful. A.) True B.) False
True
Virtual machines are now common for both personal and business use. A.) True B.) False
True
When searching for specific record information, sometimes you see duplicate files with the same name that have different data runs, meaning the file was written to disk more than once on separate occasions.
True
When you research for computer forensics tools, strive for versatile, flexible, and robust tools that provide technical support.
True
With many computer forensics tools, you can open files with external viewers.
True
What reports are generated at the local, state, and federal levels to show the types and frequency of crimes committed?
Uniform crime reports
As with any research paper, write the report abstract last. A.) True B.) False
True
How many years of education does the typical juror have?
12
When was the Freedom of Information Act originally enacted? A.) 1960s B.) 1940s C.) 1950s D.) 1970s
1960s
In an e-mail address, what symbol separates the domain name from the rest of the address?
@
What document, issued by a judge, compels the recipient to do or not do something?
A court order
What type of software runs virtual machines?
A hypervisor
What should be provided if a report is long and complex?
An abstract
A written report is often submitted as what type of document?
An affidavit
What is most appropriately used to help an attorney learn the terms and functions used in digital forensics?
An examination plan
Which document serves as a guideline for knowing what questions an investigator should expect when testifying?
An examination plan
Where do software forensics tools copy data from a suspect's disk drive?
An image file
What should be created in order to begin a digital forensics case?
An investigation plan
How often should the document describing your expertise and used to quality your testimony be updated to reflect new cases and additional training?
At least every three months
How can an investigator minimize any challenges an opposing attorney could make to discredit the investigator's report or testimony?
Be as thorough as possible during the forensic examination (?)
What name is used for the configuration typically used for e-mail messages that are distributed from a central server to many connected client computers?
Client/server architecture
Which entity was formed by the FBI in 1984 to handle the increasing number of cases involving digital evidence?
Computer Analysis and Response Team
What type of records are considered data that the system maintains, such as system log files and proxy server logs?
Computer-generated
What term refers to a column of tracks on two or more disk platters?
Cylinder
Which activity involves changing or manipulating a file to conceal information?
Data hiding
A technician is trying to recover information on a computer that has been hidden or deleted on purpose in order to hide evidence of a crime. Which type of task is the technician performing?
Data recovery
Which network defense strategy, developed by the National Security Agency (NSA), has three modes of protection?
Defense in Depth
Which group manages investigations and conducts forensic analysis of systems suspected of containing evidence related to an incident or a crime?
Digital investigations
What is the most common and flexible data-acquisition method?
Disk-to-image file copy
Which type of digital network is a faster version of GSM, designed to deliver data?
EDGE
Macintosh moved to the Intel processor and became UNIX based with which operating system?
El Capitan
What term refers to evidence that exonerates or diminishes the defendant's liability? A.) Direct B.) Inculpatory C.) Rebuttal D.) Exculpatory
Exculpatory
What was the early standard Linux file system?
Ext2
Which acronym refers to the file structure database that Microsoft originally designed for floppy disks? A.) VFAT B.) FAT C.) NTFS D.) FAT32
FAT
A search warrant can be used in any kind of case, either civil or criminal.
False
A verbal report is more structured than a written report.
False
In which discipline do professionals listen to voice recordings to determine who's speaking or read e-mail and other writings known to be by a certain person and determine whether that person wrote the e-mail or letter in question? A.) Forensic linguistics B.) Communication forensics C.) Communication linguistics D.) Linguistic analysis
Forensic linguistics
Which group often works as part of a team to secure an organization's computers and networks? A.) Computer analysts B.) Network monitors C.) Forensics investigators D.) Data recovery engineers
Forensics investigators
In what type of e-mail programs can the user copy an e-mail message by dragging the message to a storage medium, such as a folder or drive?
GUI
What tools are used to create, modify, and save bitmap, vector, and metafile graphics?
Graphics editors
Because digital forensics tools have limitations in performing hashing, what tools should be used to ensure data integrity?
Hexadecimal editors
Which type of strategy hides the most valuable data at the innermost part of the network?
Layered network defense
What type of acquisition is done if the computer has an encrypted drive and the password or passphrase is available?
Live
Which type of compression compresses data permanently by discarding bits of information in the file?
Lossy
Metadata in a prefetch file contains an application's ____ times in UTC format and a counter of how many times the application has run since the prefect file was created.
MAC
In addition to FAT16, FAT32, and Resilient File System, which file system can Windows hard disks also use?
NTFS
Which acronym refers to the file system that was introduced when Microsoft created Windows NT and that remains the main file system in Windows 10?
NTFS
Which type of forensics can help you determine whether a system is truly under attack or a user has inadvertently installed an untested patch or custom program? A.) Traffic forensics B.) Intrusion forensics C.) DDoS forensics D.) Network forensics
Network forensics
What is the standard format in U.S. federal courts for the electronic submission of documents?
Portable Document Format (PDF) (?)
What files, created by Microsoft, contain the DLL pathnames and metadata used by applications and reduce the time it takes to start applications?
Prefetch
Which type of format acquisition leaves the investigator unable to share an image between different vendors' computer forensics analysis tools?
Proprietary
What optional phase of a trial typically involves an issue raised during cross-examination of a witness?
Rebuttal
What is the main information being sought when examining e-mail headers? A.) The types of encryption being used B.) The originating e-mail's domain name or an IP address C.) The date and time the e-mail was sent D.) The type of attachments included, if any
The originating e-mail's domain name or an IP address
Under what circumstances are digital records considered admissible?
They are business records
A challenge with using social media data in court is authenticating the author and the information. A.) True B.) False
True
A forensics analysis of a 6 TB disk, for example, can take several days or weeks.
True
A good working practice is to use less powerful workstations for mundane tasks and multipurpose workstations for the higher-end analysis tasks A.) True B.) False
True
A judge can exclude evidence obtained from a poorly worded warrant. A.) True B.) False
True
After a judge approves and signs a search warrant, it's ready to be executed, meaning you can collect evidence as defined by the warrant. A.) True B.) False
True
After retrieving and examining evidence data with one tool, you should verify your results by performing the same tasks with other similar forensics tools.
True
Alternate data streams can obscure valuable evidentiary data, intentionally or by coincidence. A.) True B.) False
True
As a standard practice, collect evidence and record the tools you used in designated file folders or evidence containers.
True
Because bring your own device (BYOD) has become a business standard, investigators must consider how to keep employees' personal data separate from case evidence. A.) True B.) False
True
Before attempting to install a type 2 hypervisor, you need to enable virtualization in the BIOS before attempting to create a VM. A.) True B.) False
True
Besides presenting facts, reports can communicate expert opinion. A.) True B.) False
True
Computing systems in a forensics lab should be able to process typical cases in a timely manner. A.) True B.) False
True
For digital investigators, tracking intranet e-mail is easier because accounts use standard names the administrator establishes. A.) True B.) False
True
For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses. A.) True B.) False
True
Forensic linguistics encompasses civil cases, criminal cases, cyberterrorism cases, and other legal proceedings. A.) True B.) False
True
If a file contains information, it always occupies at least one allocation block. A.) True B.) False
True
If a graphics file is fragmented across areas on a disk, you must recover all the fragments before re-creating the file.
True
If you follow police instructions to gather additional evidence without a search warrant after you have reported the crime, you run the risk of becoming an agent of law enforcement.
True
In Autopsy and many other forensics tools raw format image files don't contain metadata. A.) True B.) False
True
In network forensics, you have to restore the drive to see how malware that attackers have installed on the system works. A.) True B.) False
True
In the United States, there's no state or national licensing body for digital forensics examiners.
True
Lawyers use services called deposition banks (libraries), which store examples of expert witnesses' previous testimony. A.) True B.) False
True
What kinds of images are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes? A.) Metafile graphics B.) Vector graphics C.) Bitmap images D.) Line-art images
Vector graphics
What Linux command is used to create the raw data format?
dd
What command creates a raw format file that most computer forensics analysis tools can read?
dd
