CIS-402 Final
In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.
1024
Ext4f can support disk partitions as large as ____ TB.
16
Briefly describe the Exchangeable Image File (EXIF) format.
A standard for storing metadata in JPEG and TIF files
What are the advantages and disadvantages of using raw data acquisition format?
Advantages: -universal, everyone can read the data -fast data transfers Disadvantages: -very high storage, has to have the capacity of the entire disk under acquisition -cannot read minor errors or correct corrupted data no tools or anything to help analyze the data
____ refers to the number of bits in one square inch of a disk platter.
Areal density
____ images store graphics information as grids of pixels.
Bitmap
The FBI ____ was formed in 1984 to handle the increasing number of cases involving digital evidenc
Computer Analysis and Response Team (CART)
____ involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example.
Data recovery
The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are called ____.
Data runs
The most common and flexible data-acquisition method is ____.
Disk-to-image file copy
When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called ____.
EFS
Most digital photographs are stored in the ____ format.
EXIF
What are some of the most common types of private-sector computer crime?
Espionage, Using company resources for personal use, Using the network for inappropriate use, Sabotage
The early standard Linux file system was ____.
Ext2
How are disk clusters numbered by Microsoft file structures (Please specify the differences in FAT and NTFS structures)?
FAT is a more primitive form of storing disk cluster numbers, it was designed for floppy disks. The information is stored in a table, storing time of access, date, information and etc. However, NTFS provided a more efficient means as it improved on the FAT. It can hold more information fields like security and etc. Also, it has smaller cluster sizes so that more data can be stored more efficiently.In NTFS, starting at 0 Address; in FAT, starting at 2 Address
Computer investigations and forensics fall into the same category: public investigations.
False
If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available.
False
Similar to Linux, Windows also has built-in hashing algorithm tools for digital forensics.
False
The first 5 bytes (characters) for all MFT records are FILE.
False
The law of search and seizure protects the rights of all people, excluding people suspected of crimes.
False
Windows OSs do not have a kernel.
False
What are some of the components of a disk drive?
Geometry-logical make-up of disk Header-read/write IO Tracks-stores data Cylinders -two or more columns tracks Sectors-collection of cylinders and tracks
Briefly describe the differences between hard links and soft links in Linux systems.
Hard links are where a direct link created for another file on the same drive. It is an exact replica of the file and is created with the command "ln". It is a link that when accessed, goes directly to that file on the same drive. A soft link is where a symbolic link is created to access another file on a completely different partition/drive. This isn't an "exact replica" but more of a pointer to where that file is stored and this can be across different drives, unlike a hard link.In addition, each symbolic link has an inode of their own while in hard links, multiple files point the same inode.
Explain the use of hash algorithms to verify the integrity of lossless compressed data.
Hash algorithms translate the text into a hash language like md5 or sha1. How it can verify data is that whenever a change occurs within the file whether it be deletion, modification, or access the hash algorithm will change. Any difference between the two hashes of different times can show that there has been some form of manipulation or change to the data.
By the early 1990s, the ____ introduced training on software for forensics investigations.
IACIS
____ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.
Inodes
Linux ISO images that can be burned to a CD or DVD are referred to as ____.
Linux Live CDs
Explain the relation between allocation blocks and logical block on a Mac OS file system.
Logical block is defined based on a size of block (cannot exceed 512 bytes) while Allocation block is a set of consecutive logical blocks to store one file.
What are logical cluster numbers (LCNs)?
Logical cluster numbers are when the data is all stored physically in that location. It acts as a resident-type file. All data is available and present, unlike VCNs where it points to another location on the partition where it is stored.
Autopsy uses ____ to validate an image.
MD5
On an NTFS disk, immediately after the Partition Boot Sector is the ____.
MFT
On older Mac OSs all information about the volume is stored in the ____.
Master Directory Block (MDB)
What are the four factors that affect the quality of image?
Number of pixels Screen resolution Graphics card Software
If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.
Sparse
What is a bad block inode on Linux?
The bad block inode keeps track of space that is unavailable. Whether it is corrupted or filled or marked as unusable, the bad block inode keeps track of where data cannot be stored and what blocks cannot be filled/used.
What are the functions of the superblock on a UNIX or Linux file system?
The superblock is in charge of the geometry of the spaces on the disk. It manages the data allocation of where the information is stored. It pushed the information out of the "outer ring" where there is space to utilize storag
A separate manual validation is recommended for all raw acquisitions at the time of analysis.
True
After a judge approves and signs a search warrant, it is ready to be executed, meaning you can collect evidence as defined by the warrant.
True
Alternate data streams can obscure valuable evidentiary data, intentionally or by coincidence.
True
Before OS X, the Hierarchical File System (HFS) was used, in which files are stored in directories (folders) that can be nested in other directories.
True
Bitmap images are collections of dots, or pixels, in a grid format that form a graphic.
True
By the 1970s, electronic crimes were increasing, especially in the financial sector.
True
Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack.
True
If a file contains information, it always occupies at least one allocation block.
True
If a graphics file is fragmented across areas on a disk, you must recover all the fragments before re-creating the file.
True
In Autopsy and many other forensics tools raw format image files don't contain metadata.
True
In Microsoft file structures, sectors are grouped to form clusters, which are storage allocation units of one or more sectors.
True
It's possible to create a partition, add data to it, and then remove references to the partition so that it can be hidden in Windows.
True
Some acquisition tools don't copy data in the host protected area (HPA) of a disk drive.
True
The Fourth Amendment to the U.S. Constitution (and each state's constitution) protects everyone's rights to be secure in their person, residence, and property from search and seizure.
True
The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your disk-to-image file.
True
The pipe (|) character redirects the output of the command preceding it.
True
The type of file system an OS uses determines how data is stored on the disk.
True
To be a successful computer forensics investigator, you must be familiar with more than one computing platform.
True
What are virtual cluster numbers (VCNs)?
VCNs act as a pointer to where the cluster/data is stored. Unlike LCNs, the information is non-resident and not physically present. The VCN has an address that points to where in the partition that file/data information is stored.VCNS are for nonresident files only
____ are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes.
Vector graphics
With Mac OSs, a system application called ____ tracks each block on a volume to determine which blocks are in use and which ones are available to receive data.
Volume Bitmap
Briefly describe the triad that makes up computer security.
Vulnerability/Threat Assessment and Risk management, Network Intrusion Detection and Incident Response, Digital Forensics
In a criminal or public case, if you have enough information to support a search warrant, the prosecuting attorney might direct you to submit a(n) ____.
affidavit
Based on the incident or crime, the complainant makes a(n) ____, an accusation or supposition of fact that a crime has been committed.
allegation
In addition to warning banners that state a company's rights of computer ownership, businesses should specify a(n) ____ who has the power to conduct investigations.
authorized requester
Recovering fragments of a file is called ____.
carving
A ____ is a column of tracks on two or more disk platters.
cylinder
The ____ is where directories and files are stored on a disk drive.
data block
The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.
dd
The process of converting raw picture data to another format is referred to as ____.
demosaicing
On Mac OSs, the ____ stores any file information not in the MDB or Volume Control Block (VCB).
extents overflow file
You use the ____ option with the dcfldd command to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512.
hash
In a files's inode, the first 10 pointers are called ____ pointers.
indirect
Published company policies provide a(n) ____ for a business to conduct internal investigations.
line of authority
Most remote acquisitions have to be done as ____ acquisitions.
live
In macOS, volumes have allocation blocks and ____ blocks.
logical
____ compression compresses data by permanently discarding bits of information in the file.
lossy
______________ Used with .jpeg files to reduce file size and doesn't affect image quality when the file is restored and viewed
lossy compression
The ____ command displays pages from the online help manual for information on Linux commands and their options.
man
The information about the first data run that is stored in the MFT record is '32 B1 07 8C 8C 00' and the information about the second data run is '22 63 07 95 ED'. What is the LCN address of the second data run?
need to go over this, 31265
The affidavit must be ____ under sworn oath to verify that the information in the affidavit is true.
notarized
One major disadvantage of ____ format acquisitions is the inability to share an image between different vendors' computer forensics analysis tools.
proprietary
In general, a criminal case follows three stages: the complaint, the investigation, and the ____.
prosecution
In older versions of macOS, a file consists of two parts: a data fork, where data is stored, and a ____ fork, where file metadata and application information are stored.
resource
Current distributions of Linux include two hashing algorithm utilities: md5sum and ____.
sha1sum
A ____ enables you to run another OS on an existing physical computer (known as the host computer) by emulating a computer's hardware environment.
virtual machine
A ____ usually appears when a computer starts or connects to the company intranet, network, or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer systems and network traffic at will.
warning banner
Microsoft has added ____ with BitLocker to its newer operating systems, which makes performing static acquisitions more difficult.
whole disk encryption
