Chapter 14 - Info & Network Security

You may use Linux to make a ______________ of the hard drive.

Forensically valid copy

In Windows the log that contains events collected from remote computers is the ____________ log.

Forwarded Events

Pedro is examining a Windows 7 computer. He has extracted the index.dat file and is examining that file. What is in the Index.dat file?

General Internet history, file browsing history, and so on for a Windows machine Internet Explorer information

If you fail to handle evidence properly ___________.

It may be unusable in court.

Older versions of Internet Explorer stores web browsing information in a file called index.dat.

True

The Windows Registry contains a list of USB devices that have been connected to the machine.

True

The Windows Registry lists USB devices that have been connected to the machine.

True

The chain of custody accounts for the handling of evidence from the moment of seizure until it is presented in court, and documents that handling.

True

Windows logging can be turned on and off with a tool called auditpol.exe.

True

Using Linux to wipe the target drive, the command-line command would be ___ .

dd

What is the name of the Standard Linux command that is also available as a Windows application that can be used to create bitstream images and make a forensic copy?

dd

The Linux log file that contains activity related to the web server is ______.

/var/log/apaches/*

The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is ______________.

/var/log/apport.log

Ian is performing a forensic examination on a Linux server. He is trying to recover emails. Where does Linux store email server logs?

/var/log/mail.*

In Linux the command to set up a target forensics server to receive a copy of a drive is dd.

False

Most Windows logs are turned on automatically.

False

The Windows command fc lists all active sessions to the computer.

False

netstat is a command you can use with a forensic copy of a machine to compare two files.

False

Windows stores information on web address, search queries, and recently opened files in a file called___________.

index.dat

Using Linux to backup your hard drive, if you want to create a hash, you would use the command-line command ___________.

md5sum

Using Linux to backup your hard drive, if you want to create a hash, you would use the command-line command ___________.

md5sum ------- THE SAME AS QUESTION #4

The Windows command to list any shared files that are currently open is ___________.

opennfiles

Frequently the first responder to a computer crime is ________.

The network administrator.

Which of the following are important to the investigator regarding logging? The logging methods Log retention Location of stored logs All of the above

All of the above

Mahmoud is using a range of Windows utilities to extract information from a computer he is triaging. He has just used the Openfiles command. The command Openfiles shows what?

Any shared files that are opened

In Windows, the log that stores events from a single application or component rather than events that might have system wide impact is the ____________ log.

Applications and services

Documentation of every person who had access to evidence, how they interacted with it, and where it was stored is called the ________________.

Chain of custody

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

Chain of custody

_________ can include logs, portable storage, emails, tablets, and cell phones.

Computer evidence

"Interesting data" is what

Data relevant to your investigation

_______ is a free tool that can be used to recover Windows files.

Disk Digger

Why should you note all cable connections for a computer you want to seize as evidence?

In case other devices were connected

When cataloging digital evidence, the primary goal is to do what?

Preserve evidence integrity

Usually, the first thing you do to a computer to prevent further tampering is to _________.

Take it offline

Frequently the first responder to a computer crime is the network administrator.

True