15 Digital Forensics Flashcards
What drives forensic activities in organizations?
Legal holds and e-discovery processes
Legal holds require organizations to preserve and protect relevant information for active or pending cases, while e-discovery involves providing forensic data as part of legal cases.
What must organizations build to respond to legal holds and e-discovery requirements?
Capability and technology to respond appropriately
This is essential to avoid losing cases in court and to support incident response processes.
What is the principle of order of volatility?
A principle used to determine the most and least volatile system components
Forensic practitioners use this to decide what to capture first during an acquisition.
What do acquisition techniques and procedures ensure?
Usable and admissible forensic data
They are crucial since different system components may change or be lost during the forensic acquisition process.
What is a key aspect of the forensic acquisition process?
Taking into account the order of volatility and acquisition circumstances
This is vital as part of incident response or legal holds.
What do image acquisition tools do?
Copy disks and volumes using a bit-by-bit method
This captures the complete image including unused or slack space.
What must incident responders maintain while capturing data?
A chain of custody
This is critical alongside the technical requirements of the systems or devices.
What is hashing used for in the forensic process?
To ensure acquired data matches its source
Commonly used hashing methods include MD5 and SHA1.
What is a limitation of checksums in forensic data validation?
They do not create unique fingerprints like hashes
Checksums can ensure data is unchanged but lack the specificity of hashes.
What must forensic reports summarize?
Key findings of the forensic analysis
They should also explain the processes, procedures, tools, and any limitations impacting the investigation.
What do forensic reports conclude with?
Recommendations or overall conclusions
These conclusions should be more detailed than the summary provided.
Fill in the blank: Forensic practitioners use _______ to ensure data integrity.
Hashing
Hashing helps verify that the acquired data has not been altered.
True or False: The forensic analysis ends when the technical examination is complete.
False
Forensic analysis continues with the creation of detailed reports outlining findings and methodologies.
