Mid-Term Exam

What are two advantages and disadvantages of the raw format?

+ Fast transfers + Most tools can read it + Ignores minor data read errors - Requires as much space as the original, suspect drive - Some tools (mostly freeware) might skip bad sectors

AFF

Advanced Forensics Format. Open-source acquisitions file format created by Dr. Simson Garfinkel.

ASCII

American Standard Code for Information Interchange

Allegation

An accusation of fact that a crime has been committed

brute force attack

An attack on passwords or encryption that tries every possible password or encryption key.

password dictionary attack

An attack that uses a collection of words or phrases that might be passwords for an encrypted file. Password recovery programs can use a password dictionary to compare potential passwords to an encrypted file's password or passphrase hash values.

secure facility

An enclosed room with a lock with true floor-to-ceiling walls, no windows, with a secure container, and a visitor's log with legible entries.

Whole Disk Encryption

An encryption technique that performs a sector-by-sector encryption of an entire drive. Each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method.

wear leveling

An internal firmware feature used in solid-state drives that ensures even wear of read/writes for all memory cells

warning banner

Asserts the right to conduct an investigation and notifies the user, often when the computer starts or connects to company intranet.

ACP

Attorney-client privlege

AFIS

Automated Fingerprint Identification System. Scans fingerprints electronically and plots the positions of their ridge characteristics, comparing them with prints in a database.

On a Windows system, sectors typically contain how many bytes? 1. 256 2. 512 3. 1024 4. 2048

B. 512

What are some ways to determine the resources needed for an investigation?

Bases on the OS of the computer you're investigating, list the software you plan to use for the investigation, noting other software, tools, or expert assistance you might need.

Why should evidence media be write-protected?

Because it maintains the quality and integrity of the evidence you're trying to preserve.

Why should you critique your case after it's finished?

Because self-evaluation and peer review are essential parts of professional growth. When a case is complete, review it to identify successful decisions and actions and determine how you could have improved your performance.

CCE

Certified Computer Examiner

CCFP

Certified Cyber Forensics Professional

CFCE

Certified Forensic Computer Examiner

tracks

Circles on a magnetic storage device where data is stored or retrieved.

data runs

Cluster addresses where files are stored on a drive's partition outside the MFT record. Data runs are used for nonresident MFT file records. A data run record field consists of three components; the first component defines the size in bytes needed to store the second and third components' content.

Forensics software tools are grouped into ____ and ____ applications.

Command line and GUI

CFTT

Computer Forensics Tool Testing. NIST's established guidelines for testing, evaluating, and validating tools.

CTIN

Computer Technology Investigators Network

Describe what should be videotaped or sketched at a computer crime scene

Computers, cable connections, overview of the scene—anything that might be of interest to the investigation.

low-level investigations

Corporate cases that require less investigative effort than a major criminal case.

CRC

Cyclic Redundancy Check. A mathematical algorithm that determines whether a file's contents have changed. It is not considered to be a forensic hashing algorithm.

What does CHS stand for?

Cylinders, Heads, Sectors

With remote acquisitions, what problems should you be aware of? a. Data transfer speeds b. Access permissions over the network c. Antivirus, antispyware, and firewall programs d. All of the above

D. All of them

RAM slack

Data from RAM that is used to fill up the last sector on a disk

Computer-generated records

Data generated by a computer, such as system log files or proxy server logs.

How many sectors are typically in a cluster on a disk drive? 1. 1 2. 2 or more 3. 4 or more 4. 8 or more

Depending on the size of the drive, but 8 or more.

network intrusion detection and incident response

Detects intruded attacks by using automated tools and monitoring network firewall logs

DEFR

Digital Evidence First Responder

DES

Digital Evidence Specialist

When you arrive at the scene, why should you extract only those items you need to acquire evidence?

Doing so protects your equipment and minimizes how many items you have to keep track of at the scene.

Which forensic tools can connect to a suspect's computer and run surreptitiously?

Encase ProDiscover

EFS

Encrypting File System. A feature within NTFS on Windows systems that supports encrypting individual files or folders for confidentiality.

Digital Evidence

Evidence consisting of information stored or transmitted in electronic form.

Exculpatory evidence

Evidence indicating that a defendant did not commit the crime.

Of all of the proprietary formats, which is the unofficial standard?

Expert Witness Compression format

Building a forensic workstation is more expensive than purchasing one. True or False?

False

Data can't be written to the disk with a command-line tool. True or False?

False

FTK Imager can acquire data in a drive's host protected area. True or False?

False

Small companies rarely need investigators. True or False?

False

The plain view doctrine in computer searches is well-established law. True or False?

False

You should always answer questions from onlookers at a crime scene. True or False?

False

A live acquisition can be replicated. True or False?

False, due to volatile memory.

Digital forensics and data recovery refer to the activities. True or False?

False.

If a visitor to your digital forensics lab is a personal friend, it's not necessary to have him or her sign the visitor's log. True or False?

False. All visitors must sign the log in order to ensure accountability and security.

Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product work. True or False?

False. Any information discovered before the memo is issued can be used in discovery by the opposition.

A forensic workstation should always have a direct broadband connection to the Internet. True or False?

False. If Internet access is needed, a second, non-Forensic workstation should be used to access the Internet.

Evidence storage containers should have several master keys. True or False?

False. In order to maintain security, the less number of keys available, the better.

Under normal circumstances, a private-sector investigator is considered an agent of law enforcement. True or False?

False. It's not until the private-sector investigator starts working at the direction of law enforcement that they are considered an agent of law enforcement.

In testing tools, the term "reproducible results" means that if you work in the same lab on the same machine, you generate the same results. True or False?

False. That is "repeatable results".

Digital forensics facilities always have windows. True or False?

False. They do not have windows in order to protect the privacy and integrity of the investigation.

You should always prove the allegations made by the person who hired you. True or False?

False. You must always maintain an unbiased perspective and be objective in your fact-finding.

FAT

File Allocation Table

List three items stored in the FAT database.

File and directory names, starting cluster numbers, file attributes, date and time stamps.

Police in the United States must use procedures that adhere to which of the following? 1. Third Amendment 2. Fourth Amendment 3. First Amendment 4. None of the above

Fourth Amendment

HAZMAT

Hazardous Materials

HPFS

High Performance File System - A file system created specifically for the OS/2 operating system to improve upon the limitations of the FAT file system. Among its improvements are: support for mixed case file names, support for long file names (255 characters), more efficient use of disk space, less fragmentation of data

HTCN

High Tech Crime Network

HPA

Host Protected Area. The area of the drive that's not normally visible to the OS.

Why should you do a standard risk assessment to prepare for an investigation?

Identifying the risks can help mitigate or minimize any foreseeable issues with the investigation.

BootSect.dos

If a machine has multiple booting OSs, NTLDR reads BootSect.dos, which is a hidden file, to determine the address (boot sector location) of each OS. See also NT Loader (Ntldr).

attribute id

In NTFS, an MFT record field containing metadata about the file or folder and the file's data or links to the file's data.

Info2 file

In Windows NT through Vista, the control file for the Recycle Bin. It contains ASCII data, Unicode data, and date and time of deletion.

professional conduct

Includes ethics, morals, and standards of behavior

Inculpatory evidence

Incriminating evidence

bootstrap process

Information contained in ROM that a computer accesses during startup; this information tells the computer how to access the OS and hard drive.

You have been called to the scene of a fatal car crash where a laptop computer is still running. What type of field kit should you take with you?

Initial-response field kit

Device drivers contain what kind of information?

Instructions for the OS on how to interface with hardware devices.

IACIS

International Association of Computer Investigative Specialists

As a private-sector investigator, you can become an agent of law enforcement when which of the following happens? 1. You begin to take orders from a police detective without a warrant or subpoena. 2. Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement. 3. Your internal investigation begins. 4. None of the above.

1

If a suspect computer is running Windows 10, which of the following can you safely perform? 1. Browsing open applications 2. Disconnecting power 3. Either of the above 4. None of the above

1

Private-sector investigations are typically easier than law enforcement investigations for which of the following reasons? 1. Most companies keep inventory databases of all hardware and software used. 2. The investigator doesn't have to get a warrant. 3. The investigator has to get a warrant. 4. Users can load whatever they want on their machines.

1, 2

Which of the following is true of most drive-imaging tools? (Choose all that apply.) 1. They perform the same function as a backup 2. They ensure that the original drive doesn't become corrupt and damage the digital evidence. 3. They create a copy of the original drive. 4. They must be run from the command line.

1, 2, 3

Which of the following techniques might be used in covert surveillance? 1. Keylogging 2. Data sniffing 3. Network logs 4. None of the above

1, 2, 3

When validating the results of a forensic analysis, you should do which of the following? (Choose all that apply) 1. Calculate the hash value with two different tools. 2. Use a different tool to compare the results of evidence you find. 3. Repeat the steps used to obtain the digital evidence, using the same tool, and recalculate the hash value to verify the results. 4. Use a command-line tool and then a GUI tool.

1, 2, 3 (?)

The reconstruction function is needed for which of the following purposes? (Choose all that apply.) 1. Re-create a suspect drive to show what happened. 2. Create a copy of a drive for other investigators. 3. Recover file headers. 4. Re-create a drive compromised by malware.

1, 2, 4

If a suspect's computer is found in an area that might have toxic chemicals, you must do which of the following? 1. Coordinate with the HAZMAT team. 2. Determine a way to obtain the suspect's computer. 3. Assume the suspect's computer is contaminated. 4. Do not enter alone.

1, 3

The verification function does which of the following? 1. Proves that a tool performs as intended 2. Creates segmented files 3. Proves that two sets of data are identical via hash values 4. Verifies hex editors

1.

List two popular certification programs for digital forensics.

1. CFCE - Certified Forensic Computer Examiner 2. CCFP - Certified Cyber Forensic Professional

A log report in forensics tools does which of the following? 1. Tracks file types 2. Monitors network intrusion attempts 3. Records an investigator's actions in examining a case 4. Lists known good files

3. Records an investigator's actions in examining a case

The standards for testing forensics tools are based on which criteria? 1. U.S. Title 18 2. ASTD 1975 3. ISO 17025 4. All of the above

3. USI 17025

According to ISO standard 27037, which of the following is an important factor in data acquisition? (Choose all that apply) 1. The DEFR's competency 2. The DEFR's skills in using the command line 3. Use of validated tools 4. Conditions at the acquisition setting

3. Use validated tools

recovery certificate

A method NTFS uses so that a network administrator can recover encrypted files if the file's user/creator loses the private key encryption code.

head and cylinder skew

A method manufacturers use to minimize lag time. The starting sectors of tracks are slightly offset from each other to move the read-write head.

file system

A method used by operating systems to store, retrieve, and organize files.

one-time passphrase

A password used to access special accounts or programs requiring a high level of security, such as a decryption utility for an encrypted drive. This passphrase can be used only once, and then it expires.

business case

A plan you can use to sell your services to management or clients

Initial-response field kit

A portable kit containing only the minimum tools needed to perform disk acquisitions and preliminary forensics analysis in the field.

extensive-response field kit

A portable kit designed to process several computers and a variety of operating systems at a crime or incident scene involving computers. This kit should contain two or more types of software or hardware computer forensics tools, such as extra storage drives.

Evidence custody form

A printed form indicating who has signed out and been in physical possession of evidence.

configuration management

A process of recording all the updates made to your workstation

Sector

A section on a track, usually made up of 512 bytes

device drivers

A software program that provides the instructions your computer needs to communicate with a device

Forensic Workstation

A specially configured PC loaded with additional bays and forensics software

Boot.ini

A startup file for Windows XP that specifies the path installation and contains options for selecting the Windows version.

Affidavit

A sworn statement of support of facts about or evidence of a crime

nonkeyed hash set

A unique hash number generated by a software tool and used to identify files.

keyed hash set

A value created by an encryption utility's secret key.

What's a hashing algorithm?

A way of creating a binary or hexadecimal number that represents the uniqueness of the drive or data set; it's "digital fingerprint"

Validation

A way to confirm that a tool is function as intended.

innocent information

- Unrelated information - Often included with the evidence you're trying to recover

Clusters in Windows always begin numbering at what number?

0 in NTFS. 2 in FAT.

hostile work environment

A work environment that can result in an employee's civil lawsuit against the company that does nothing to prevent or respond to it.

Which organization has guidelines on how to operate a digital forensics lab?

ANAB (ANSI-ASQ National Accreditation Board)

ANAB

ANSI-ASQ National Accreditation Board

EFS can encrypt which of the following? a. Files, folders, and volumes b. Certificates and private keys c. The global registry d. Network servers

a.

probable cause

the standard specifying whether a police officer has the right to make an arrest, conduct a personnel or property search or obtain a warrant for arrest

In FAT32, a 123 KB files uses how many sectors?

It depends on how the OS determined the cluster size.

What's a virtual cluster number?

It represents the assigned clusters of files that are nonresident in the MFT. If a file has become fragmented, it can have two or more VCNs. The first VCN for a nonresident file is listed as 0.

Why was EFI boot firmware developed?

It was designed to provide better protection against malware than BIOS does.

Why is it good practice to make two images of a suspect drive in a critical investigation?

It's helpful in making sure that data has been copied correctly. It also protects against loss and minimizes the risk of failure in the investigation.

search warrants

Legal documents that authorize a police officer or other officials to enter and search a premise

single-evidence form

Lists each piece of evidence on a separate page

Keyword search

Looks for words anywhere in the data.

Digital Investigations

Manages investigations and conducts forensics analysis of systems suspected of containing evidence. Fall into two categories: 1. Public sector 2. Private sector

MBR

Master Boot Record. An area on a hard disk in its first sector. When the BIOS boots a system, it looks at the MBR for instructions and information on how to boot the disk and load the operating system. Some malware tries to hide here.

MFT

Master File Table

What does MFT stand for?

Master File Table

MD5

Message Digest 5. A hashing function used to provide integrity.

Which organization provides good information on safe storage containers?

NISPOM (National Industrial Security Program Operating Manual) - Chapter 5, Section 3

NIST

National Institute of Standards and Technology

NSRL

National Software Reference Library. A compiled list of known file hashes for a variety of OSs, applications, and images. Currently adding hash values for iOS and Android applications.

NTFS

New Technology File System

In Linux, the fdisk -l command lists the suspect drive as /dev/hda1. Is the following dcfldd command correct? dcfldd if=image_file.img of=/dev/hda1

No! if is "input file". This process is reversed of what is should be.

Evidence bags

Nonstatic bags used to transport removable media, hard drives, and other computer components.

Static Acquisitions

Normally done on a system or drive that has been seized, often with a write-blocking device to prevent writing to the suspect disk.

areal density

Number of bits per square inch of a disk platter

covert surveillance

Observing people or places without being detected, often using electronic equipment, such as video cameras or key stroke/screen capture programs.

In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?

On newer OSs, none.

Virtual Machine

One or more logical machines created within one physical machine.

unallocated disk space

Partition disk space that isn't allocated to a file. This space might contain data from files that have been deleted previously.

PII

Personally Identifiable Information. Information about individuals that can be used to trace a person's identity, such as a full name, birthdate, biometric data, and identifying numbers such as a Social Security number (SSN). Organizations have an obligation to protect PII and often identify procedures for handling and retaining PII in data policies.

Live Acquisition

Powered-on device, logged on by the user

What's the main goal of static acquisition?

Preservation of digital evidence

What is professional conduct, and why is it important?

Professional conduct is the ethics, morals, and standards by which you conduct yourself and you business. It is important because it determines your credibility.

Fourth Amendment

Protection from unlawful search and seizure.

Verification

Proves that two sets of data are identical by calculating has values or using another similar method.

RAID

Redundant Array of Independent Disks. A computer configuration of two or more disks, originally developed as a data-redundancy measure. RAID 0, 1, 2, 3, 5, 10, 15

Typically, a(n) ______ lab has a separate storage area or room for evidence

Regional

repeatable findings

Repeat the steps and produce the same result

ReFS

Resilient File System

Chain of custody

Route the evidence takes from the time you find it until the case is closed or goes to court.

List two hashing algorithms commonly used for forensic purposes.

SHA-1 (and its variants), MD5

SWGDE

Scientific Working Group on Digital Evidence

Physical address

Sector numbers that reside at the hardware or firmware level and go from address 0 to last on disk.

Commingling evidence means what in a private-sector setting?

Sensitive business information is mixed with the data that is collected as evidence.

Sparse Acquisition

Similar to logical acquisition in that it gathers files and file types, bu also gathers fragments of deleted data

Raw forensic file format

Simple, sequential flat files of a suspected drive or data set, readable by almost all forensic acquisition tools

Authorized requester

Someone who has the power to initiate investigations

person of interest

Someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.

What does a logical acquisition collect for an investigation?

Specific files or file types

What does a sparse acquisition collect for an investigation?

Specific files or file types, as well as fragments from unallocated areas

line of authority

States who has the legal right to initiate an investigation, who can take possession of evidence, and who can have access to evidence.

Partition Boot Sector

Stores info important to its partition, such as the location of OS boot files.

What term refers to labs constructed to shield EMR (electromagnetic radiation) emissions?

TEMPEST

Exhibits

Tangible material that either supports or refutes the allegation

vulnerability/threat assessment and risk management

Tests and verifies the integrity of stand-alone workstations and network servers

What do you call a list of people who have had physical possession of the evidence?

The Chain of Custody

search and seizure

The Fourth Amendment gives protection against unlawful search and seizure

Hal.dll

The Hardware Abstraction Layer dynamic link library allows the OS kernel to communicate with hardware.

Ntoskrnl.exe

The Windows OS kernel.

Pagefile.sys

The Windows swap file that is used to hold the virtual memory that is used to enhance physical memory installed in a system.

Reconstruction

The ability to recreate a suspect drive to show what happened during a crime or an incident.

Logical Acquisition

The acquisition of specific files or file types

What should you consider when determining which data acquisition method to use?

The circumstance of the investigation. Namely, the scope and length of possession.

Data recovery

The customer or company just wants the data back. Don't care about legal matters.

With newer Linux kernel distributions, what happens if you connect a hot-swappable device, such a USB drive, containing evidence?

The device is automatically mounted and access. This likely alters the metadata.

head

The device that reads and writes data to a drive.

Acquisition

The first task in digital forensics investigations; making a copy of the original drive.

SHA-1

The first version of Secure Hash Algorithm, developed by NIST and slowly replacing CRC and MD5.

risk management

The forecasting and evaluation of risks, together with the identification of procedures to avoid or minimize their impact.

Plain View Doctrine

The legal principle that objects in plain view of a law enforcement agent who has the right to be in a position to have that view may be seized without a warrant and introduced as evidence.

digital forensics lab

The locations where you conduct investigations, store evidence, and do most of your work.

professional curiosity

The presence of police officers and other professionals who are not part of the crime scene-processing team. Their presence can contaminate the scene, either directly or indirectly.

Digital Forensics

The process of systematically accumulating and analyzing digital information for use as evidence in a civil, criminal, or administrative case

interrogation

The process of trying to get a suspect to confess

Extraction

The recovery task in a digital investigation and the most challenging of all tasks to master.

TEMPEST

The required shielding of sensitive computing systems and the prevention of electronic eavesdropping of computer emissions

industrial espionage

The selling of sensitive or confidential company information to a competitor.

track density

The space between tracks on a disk. The smaller the space between tracks, the more tracks on a disk. Older drives with wider track densities allowed the heads to wander.

What are the necessary components of a search warrant?

The suspect's computer and its components. 1. It must be filled in good faith by a law enforcement officer 2. It must be based on reliable information showing probable cause to search 3. It must be issued by a neutral and detached magistrate 4. It must state specifically the place to be searched and the items to be seized

file slack

The unused space created when a file is saved. If the allocated space is larger than the file, the remaining space is slack space and can contain passwords, logon IDs, file fragments, and deleted e-mails.

white-collar crimes

These crimes are characterized by deceit, concealment, or violation of trust and are not dependent on the application or threat of physical force or violence. The motivation behind these crimes is financial—to obtain or avoid losing money, property, or services or to secure a personal or business advantage.

Why is physical security so critical for digital forensics labs?

To maintain chain of custody and prevent data from being lost, corrupted, or stolen

What's the purpose of maintaining a network of digital forensics specialists?

To supplement your knowledge and be able to get referrals and information when needed

What's the purpose of an affidavit?

To support facts about or evidence of a crime, in order to secure a warrant for seizure

An encrypted drive is one reason to choose a logical acquisition. True or False?

True

An image of a suspect drive can be loaded on a virtual machine. True or False?

True

Computer peripherals or attachments can contain DNA evidence. True or False?

True

EnCase, FTK, SMART, and ILookIX treat an image file as though it were the original disk. True or False?

True

Hardware acquisition tools typically have built-in software for data analysis. True or False?

True

If a company doesn't distribute a computing use policy stating an employer's rights to inspect employee's computers freely, including e-mail and web use, employees have an expectation of privacy. True or False?

True

If you discover a criminal act while investigating a company police abuse, the case becomes a criminal investigation and should be referred to law enforcement. True or False?

True

In NTFS, files smaller than 512 bytes are stored in the MFT. True or False?

True

In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a private-sector investigator can conduct covert surveillance on an employee with little cause. True or False?

True

The primary hashing algorithm the NSRL project uses is SHA-1. True or False?

True

Zone bit recording is how disk manufacturers ensure that a platter's outer tracks store as much data as possible. True or False?

True

The ANAB mandates the procedures established for a digital forensics lab. True or False?

True (?)

For digital evidence, an evidence bag is typically made of antistatic material. True or False?

True.

An employer can be held liable for e-mail harassment. True or False?

True. An employer is responsible for preventing and investigating harassment of employees and nonemployees associated with the workplace.

List two features NTFS has that FAT does not.

Unicode characters, security, journaling.

UCR

Uniform Crime Report

Partition gap

Unused space between partitions

drive slack

Unused space in a cluster between the end of an active file and the end of the cluster

What does the Ntuser.dat file contain?

User-protected storage area; contains the list of the most recently used files and desktop configuration settings

interview

Usually conducted to collect information from a witness or suspect about specific facts related to an investigation.

What's the most critical aspect of digital evidence?

Validating

VCN

Virtual Cluster Number

VHD

Virtual Hard Disk

Alternate Data Streams

Ways in which data can be appended to a file (intentionally or not) and potentially obscure evidentiary data. In NTFS, these become an additional file attribute.

logical addresses

When files are saved, they are assigned to clusters, which the OS numbers sequentially starting at 2. Logical addresses point to relative cluster positions, using these assigned cluster numbers.

Partition

When referring to a computer hard drive, a disk partition or partition is a section of the hard drive that is separated from other segments. Partitions help enable users to divide a computer hard drive into different drives or different portions for a number of reasons.

In forensic hashes, when does a collision occur?

When the hash value is equivalent to another hash value generated from a different data set. These collisions are rare and have really only been detected on supercomputers.

Ntldr (NT Loader)

Windows NT/2000/XP boot file. Launched by the MBR or MFT, ntldr looks at the boot.ini configuration file for any installed operating systems.

What's the advantage of a write-blocking device that connects to a computer through a FireWire or USB controller?

You can remove and reconnect drives without having to restart the workstation.

ZBR

Zone bit recording, how most manufacturers deal with a platter's inner tracks having a smaller circumference and therefore less space to store data than in the outer tracks.

limiting phrase

a judge will often issue this in a warrant, which allows police to separate innocent info from evidence when commingled evidence is found

NTDETECT.COM

a required boot file for Windows operating systems through XP, responsible for detecting hardware necessary for a successful boot into Windows

public key

a value that can be used to encrypt a message. However, only when combined with a mathematically-related private key, can the message be decrypted.

The manager of a digital forensics lab is responsible for which of the following? (Choose all that apply) a. Making necessary changes in lab procedures and software b. Ensuring that staff members have enough training to do the job c. Knowing the lab objectives d. None of the above

a, b, c

Hard drive geometry

specifications of hard drives listing the number cylinders, heads and sectors

private key

the complementary key to a public key that is used to decrypt a message.

List three items that should be on an evidence custody form.

1. Case number 2. Investigating organization 3. Investigator's name 4. Nature of the case 5. Location where the evidence was obtained 6. Description of the evidence 7. Vendor's name 8. Model number or serial number 9. Who the evidence was recovered by 10. Date and time evidence was taken into custody 11. Evidence placed in which locker and when it was placed there 12. Item #/Evidence processed by/Disposition of evidence/Data/Time 13. Page #

List three subfunctions of the extraction function.

1. Data viewing 2. Keyword searching 3. Decompressing or uncompressing 4. Carving 5. Decrypting 6. Bookmarking or tagging

List two types of digital investigations typically conducted in a business environment.

1. Employee termination cases 2. Internet abuse investigations 3. E-mail abuse investigations 4. Attorney-Client privilege investigations 5. Industrial espionage investigations

Name two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive

1. EnCase 2. X-Way Forensics

In the Linux dcfldd command, which three options are used for validating data?

1. Hashing via MD5, SHA-1, SHA-256, SHA-384, SHA-512 2. Verifying with the original disk or media data 3. Logging of errors to an output file for analysis and review 4. Referring to a status display indicating acquisition's progress in bytes

What are the three rules for a forensic hash?

1. It can't be predicted. 2. No two files can have the same hash value 3. If the file changes, the hash value changes.

What items should your business plan include?

1. Justification 2. Budget - including facility costs, hardware and software requirements, as well as misc. 3. Approval/Acquisition Methods - w/ risk analysis and the number of investigations you plan on pursuing and their average length 4. Implementation - how to incorporate and install all approved items and a timeline for delivery/installation/and inspection of the facility 5. Acceptance Testing - making sure everything works 6. Correction for Acceptance 7. Production

List three items that should be in an initial-response field kit.

1. Laptop 2. Camera 3. Flash light 4. Digital forensics kit Note - The list given here is not extensive. Ref Loc 5293 for a full list

List two features common with proprietary format acquisition files

1. Option to compress 2. Ability to split images for archival purposes 3. Ability to integrate metadata into the image

Name the three formats for computer forensics data acquisitions.

1. Raw 2. Proprietary 3. AFF (Advanced Forensics Format)

What three items should you research before enlisting in a certification program?

1. Requirements 2. Cost 3. Acceptability in your area of employment

What are the two main concerns when acquiring data from a RAID server?

1. Size 2. Configuration

List two items that should appear on a warning banner.

1. That the connection is restricted to authorized users 2. That the organization has a right to inspect and monitor computer and network usage

To determine the types of operating systems needed in your lab, list two sources of information you could use.

1. The Uniform Crime Report (UCR) 2. A list of crimes in your area or company

When you preform an acquisition at a remote location, what should you consider to prepare for the task?

1. The advanced privileges that are requires to push the agent application to the remote system 2. The antivirus, antispyware, or firewall applications that can be programmed to ignore remote access programs 3. That the suspect could have security tools that trigger an alarm on remote access intrusions

Hashing, filtering, and file header analysis make up which function of computer forensics tools? 1. Validation and verification 2. Acquisition 3. Extraction 4. Reconstruction

1. Validation and verification

List three items that should be in your case report.

1. What you did 2. What you found 3. Answer: Who, What, When, Where, How 4. Know your target reader and write for them 5. Provide an explanation for processes and how systems and their components work

Large digital forensics labs should have at least ______ exits.

2

What is the maximum file size when writing to FAT32 drives?

2 GB

Hash values are used for which of the following purposes? (Choose all that apply.) 1. Determining file size 2. Filtering known good files from potentially suspicious data 3. Reconstructing file fragments 4. Validating that the original data hasn't changed.

2, 4

What is the space on a drive called when a file is deleted? (Choose all that apply.) 1. Disk space 2. Unallocated space 3. Drive space 4. Free space

2, 4

The triad of computing security includes which of the following? 1. Detection, response, and monitoring 2. Vulnerability assessment, detection, and monitoring 3. Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation 4. vulnerability assessment, intrusion response, and monitoring

3. Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation

Policies can address rules for which of the following? 1. When you can log on to a company network from home 2. The Internet sites you can or can't access 3. The amount of personal e-mail you can send 4. Any of the above

4. Any of the above

Bit-stream copy

A bit-by-bit copy of the original storage medium. An exact copy of the original disk.

ISO image

A bootable file that can be copied to CD or DVD; typically used for installing operating systems. It can also be read by virtualization software when creating a virtual boot disk

Unicode

A character code that enables most of the languages of the world to be symbolized with a special character identification.

UTF-8

A coding system for storing characters in bits, extending the 8-bit ASCII coding system to include international characters by sometimes using more than 8 bits.

cylinder

A column of tracks on two or more disk platters.

Registry

A database that Windows uses to store hardware and software configuration information, user preferences, and setup information.

verdict

A decision on a disputed issue in a civil or criminal case

NTBOOTDD.SYS

A device driver that allows the OS to communicate with SCSI or ATA drives that aren't related to the BIOS.

Bit-stream image

A file containing the bit-stream copy of all data on a disk or partition

multi-evidence form

A form that allows you to list multiple pieces of evidence on a single page

clusters

A grouping of sectors

Write Blocker

A hardware device or software program that prevents a computer from writing data to an evidence drive. Software write-blockers typically alter interrupt-13 write functions to a drive in a PC's BIOS. Hardware write-blockers are usually bridging devices between a drive and the forensic workstation.

hash value

A hexadecimal code based on the contents of a file, folder, or entire drive.

Approved Secure Container

A lccked, fireproof locker or cabinet that has limited access.

Virtual machines have which of the following limitations when running on a host computer? a. Internet connectivity is restricted to virtual websites b. Applications can be run on the virtual machines only if they're resident on the physical machine. c. Virtual machines are limited to the host computer's peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices. d. Virtual machines can run only OSs that are older than the physical machine's OS.

c.

What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder? a. The file can no longer be encrypted b. EFS protection is maintained on the file c. The file is unencrypted automatically d. Only the owner of the file can continue to access it

c.

Areal density refers to which of the following? a. Number of bits per disk, b. Number of bits per partition, c. Number of bits per square inch of a disk platter, d. Number of bits per platter

c. Number of bits per square inch of a disk platter

Sniffing

capturing and recording network traffic

Building a business case can involve which of the following? a. Procedures for gathering evidence b. Testing software c. Protecting trade secrets d. All of the above

d. All of the above

Which of the following Windows 8 files contains user-specific information? a. User.dat b. Ntuser.dat c. System.dat d. SAM.dat

d. SAM.dat

metadata

data that describes other data

computer-stored records

electronic data that a person creates and saves on a computer or digital device, such as a spreadsheet or word document

LCNs

logical cluster numbers