Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ SY601 > 9 - 4: Forensic Techniques > Flashcards

9 - 4: Forensic Techniques Flashcards

1
Q

Four main types of investigations

A

1) Operational/Administrative 2) Criminal Investigations 3) Civil Investigations 4) Regulatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Operational investigations

A

Investigate issues in technology services/performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Criminal investigations

A

Intended to investigate criminal activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Civil investigations

A

Non-criminal legal offenses involving a dispute between two parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Regulatory investigations

A

Carried out by government or other regulatory bodies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Interrogations

A

When an interview subject withdraws consent, is only for law enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Types of evidence

A

1) Real evidence 2) Documentary evidence 3) Testimonial evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Real evidence

A

Tangible items

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Documentary evidence

A

Information in written or digital form, including logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Documentary evidence rules

A

1) must be authenticated, attested to its legitimacy 2) best evidence 3) parole evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Best evidence rule

A

Original documents are always superior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Parole evidence rule

A

The court assumes a written agreement between to parties to be the only agreement and no verbal agreement is legally binding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Testimonial evidence

A

A statement written or said under oath

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Direct evidence

A

Witness recounts what they observed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Testimonial evidence types

A

1) Direct evidence 2) Expert Opinion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Expert opinion

A

The court recognizes an authority in a field to interpret information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Hearsay

A

Evidence based on what one person told another, not admissible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Goal of digital forensics

A

Collect, preserve, analyze, and interpret digital evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Volatility

A

The permanence or likelihood to change a piece of evidence has

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Order of volatility

A

1) Network traffic 2) Memory Contents 3) System and process data 4) Files 5) Logs 6) Archived Records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Time offsets

A

Difference in timestamps between data evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

First rule of investigation

A

NEVER alter data captured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Forensic file reading

A

1) Create an image of the physical media 2) use a write-blocker/forensic disk controller to prevent any data editing or creation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Tamper-proofing

A

Sealed bags for physical media, hashing for digital

25
Q

File carving

A

Technique for combing through unallocated disk space to find deleted files

26
Q

Bulk extractor

A

A command-line file carving tool

27
Q

WinHex

A

A file carving tool that allows accessing binary file data

28
Q

Disc acquisition

A

Create an image of a disk for forensic review

29
Q

Common forensics tools

A

Autopsy, EnCase, and FTK (Forensics toolkit)

30
Q

Forensic workstation

A

Needs a lot of RAM, high-end CPU, lots of disk storage

31
Q

Live analysis

A

Retrieves volatile data components

32
Q

Memory dump

A

A technique for dumping RAM to forensic storage

33
Q

Sysinternals

A

A Windows-only forensics tool

34
Q

AccessEnum

A

Access enumerator, a forensic tool showing what users and groups have what permissions

35
Q

Swap files/page files

A

Temporary files that contain portions of memory at a point-in-time while memory is being written

36
Q

Autoruns

A

A utility showing what programs or scripts run at system boot

37
Q

Process Explorer

A

A hierarchical diagram of Windows programs showing what processes have activated other processes

38
Q

TCPView

A

Shows all active network connections to or from your system

39
Q

Linux password storage

A

Passwords are kept on a file with a one-way hash

40
Q

Shadow password file

A

A separate file where Linux password hashes are stored

41
Q

Secure hashing requires avoiding ____

A

Collision

42
Q

Dictionary attack

A

Tries English words as passwords first

43
Q

Rainbow Table attack

A

attempts pre-computed hashes

44
Q

Hybrid attack

A

Uses variations in spelling and characters while guessing passwords

45
Q

Ethernet networks

A

Send electrical signals over copper wire

46
Q

Wireless networks

A

Emit radio waves over the air

47
Q

Fiber-optic networks

A

Light pulses sent over glass

48
Q

Major uses of software forensics

A

1) resolve intellectual property disputes 2) identify malware origins

49
Q

Embedded devices

A

Special-purpose computers within smart devices. Typically cloud connected

50
Q

Chain of custody

A

A documented trail of who has owned what evidence

51
Q

3 Major steps of legal electronic discovery

A

1) Preservation 2) Collection 3) Production

52
Q

Preservation

A

A legal hold is issued notifying electronic records must be kept for a certain timeframe

53
Q

Preservation includes stopping:

A

Any process that automatically destroys data

54
Q

Collection

A

Once legal has decided to pursue litigation, cybersecurity teams may be required to assist with finding data

55
Q

Production

A

Legal provides collected electronic evidence to the other party

56
Q

Metasploit

A

The most commonly used exploitation tool

57
Q

shasum

A

A hashing tool available in a forensic toolkit

58
Q

dd

A

A disk imaging tool

Security+ SY601 (29 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions