Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

C702 > Ch. 5 > Flashcards

Ch. 5 Flashcards

1
Q

Where are deleted items stored on Windows Vista and later versions of Windows?

A

Drive:$Recycle.Bin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where are deleted items stored on Windows 98 and earlier versions of Windows?

A

Drive:\RECYCLED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where are deleted items stored on the Windows 2000, XP, and NT versions of Windows?

A

Drive:\RECYCLER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the maximum size limit for the Recycle Bin in Windows prior to Windows Vista?

A

3.99 GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Recover My Files Features:

A
  • Recovers files even if emptied from Recycle Bin data
  • Recovers files after accidental format, even after Windows is reinstalled
  • Performs disk recovery after a hard disk crash
  • Recovers files after a partitioning error
  • Recovers data from RAW hard drives
  • Recovers documents, photos, videos, music, and email
  • Recovers from a hard drive, camera card, USB, Zip, floppy disk, or other media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What tool is used for format recovery, unformatting and recovering deleted files emptied from the Recycle Bin, or data lost due to partition loss or damage, software crash, virus infection, or unexpected shutdown and supports hardware RAID?

A

EaseUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What tool undeletes and recovers lost files from hard drives, memory cards, and USB flash drives?

A

DiskDigger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What tool recovers files that have been lost, deleted, corrupted, or even deteriorated?

A

Quick Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What tool recovers lost data from hard drives, RAID, photographs, deleted files, iPods, and removable disks connected via FireWire or USB?

A

Total Recall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What tool scans an entire system for deleted files and folders and recovers them, providing two types of scans: a quick scan and a deep scan?

A

Advanced Disk Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What tool for Mac recovers files from a crashed or virus-corrupted hard drive and can recover all file types from any HFS/HFS+ formatted drive?

A

Data Rescue 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What anti-forensics technique is used to hide secret data within ordinary data, thereby hiding the existence of such data?

A

Steganography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the process of applying a strong magnetic field to a storage device, resulting in a device entirely clean of any previously stored data?

A

Disk degaussing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What process does not erase the data present on a disk but wipes its address tables and unlinks all the files in the file system?

A

Formatting of a hard drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What process involves erasing data from a disk by deleting its links to memory blocks and overwriting the memory contents?

A

Disk wiping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What password-cracking technique requires more processing power compared to other attacks?

A

Brute-forcing attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What kind of attack is used when some information about the password is known?

A

Rule-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a precomputed table that contains word lists in the form of dictionary files and brute-force lists and their hash values?

A

Rainbow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Methods to Bypass/Reset BIOS password

A
  • Using a manufacturer’s backdoor password to access the BIOS
  • Using password cracking software
  • Resetting the CMOS using jumpers or solder beads
  • Removing the CMOS battery for at least 10 minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a set of techniques that attackers use in order to avert the forensics investigation process and negatively affect the quantity and quality of evidence?

A

Anti-forensics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In the File Allocation Table (FAT) file system, what does the OS replace the first letter of a deleted file name with a hex byte code of?

A

E5h

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the master database file that is crucial for the recovery of data and contains various details of deleted files such as their original file name, original file size, date and time of deletion, unique identifying number, and the drive number in which the file was stored?

A

INFO2

23
Q

What method do attackers use to hide malicious data within hidden areas of a system’s hard drive or within other files?

A

Hiding data in file system structures

24
Q

What method do attackers use to confuse or deceive forensic investigators by tampering with logs, modifying file headers, and changing timestamps?

A

Trail obfuscation

25
Q

In what method do attackers modify the file extension of malicious program files so that such files can go undetected on a system and steal sensitive user data?

A

File extension mismatch

26
Q

What anti-forensics technique uses a program to compress or encrypt executable programs in an effort to hide attack tools from being detected?

A

Program Packers

27
Q

Anti-forensics Techniques that Minimize Footprint

A
  • Use of fake or stolen identities
  • Running OSes from Live CDs/DVDs/USB
  • Use of virtual machines
  • Use of cloud services
28
Q

Anti-forensics Countermeasures

A
  1. Train and educate the forensic investigators about anti-forensics
  2. Validate the results of examination using multiple tools
  3. Impose strict laws against illegal use of anti-forensics tools
  4. Understand the anti-forensic techniques and their weaknesses
  5. Use latest and updated CFTs and test them for vulnerabilities
  6. Save data in secure location
  7. Use intelligent decompression libraries to defend against compression bombs
  8. Replace weak file heuristics with stronger ones
29
Q

What commands can be used to determine Windows logged-on users?

A

PsLoggedOn
LogonSessions
Net sessions

30
Q

What command is used to determine open files in Windows?

A

Net file

31
Q

What command is used to determine the NetBIOS name table cache in Windows?

A

Nbtstat

32
Q

What tool helps collect information about network connections operating in a Windows system?

A

Netstat

33
Q

What commands are used to determine running processes in Windows?

A

Tasklist
Listdlls
Pslist

34
Q

What is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples?

A

Volatility Framework

35
Q

The information about the system users is stored in which file for Windows?

A

SAM database file

36
Q

The value 0 associated with the registry entry EnablePrefetcher tells the system to use which prefetch?

A

Prefetching is disabled.

37
Q

What prefetch does value 1 from the registry entry EnablePrefetcher tell the system to use?

A

Application prefetching is enabled.

38
Q

What prefetch does value 2 from the registry entry EnablePrefetcher tell the system to use?

A

Boot prefetching is enabled.

39
Q

What prefetch does value 3 from the registry entry EnablePrefetcher tell the system to use?

A

Both application and boot prefetching are enabled.

40
Q

What tool enables you to retrieve information about event logs and publishers in Windows 10?

A

Wevtutil

41
Q

Intruders attempting to gain remote access to a system try to find the other systems connected to the network and visible to the compromised system. True/False

A

True

42
Q

________ command is used to display the network configuration of the NICs on the system.

A

ipconfig /all

43
Q

What are the unique identification numbers assigned to Windows user accounts for granting user access to particular resources?

A

Microsoft security ID

44
Q

In Windows Event Log File Internals, what file is used to store the Databases related to the system?

A

System.evtx

45
Q

Thumbnails of images remain on computers even after files are deleted. True/False

A

True

46
Q

In Windows, where is the default location of the spool folder located?

A

C:\Windows\System32\spool\PRINTERS

47
Q

What is the space generated between the end of a stored file and the end of the disk cluster called?

A

Slack space

48
Q

What Windows Registry hives are considered nonvolatile with respect to data persistence?

A

HKEY_LOCAL_MACHINE, HKEY_USERS

49
Q

By default, Windows XP and later create hidden administrative shares on a system. True/False

A

False. By default, Windows Vista, 7, 8.1, and 10 create hidden administrative shares on a system.

50
Q

When a USB device is plugged into a Windows machine, what in Windows receives the event and queries the device descriptor in the firmware for device information?

A

Plug and Play Manager

51
Q

What would not be found on a most recently used list?

A

Bookmarks. MRU list will contain recently visited web pages and opened documents.

52
Q

What does analyzing Shellbags not provide forensic investigators with information about?

A

Folders not opened from an external hard drive after the drive is unmounted.

53
Q

The CustomDestinations jump list is made of files that are created when a user pins a file or an application to a taskbar. True/False

A

True

C702 (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions