Chapter 13 Flashcards
What are the components of a forensic toolkit?
Workstation
Cables and adapters
Forensic software
Write blockers
Duplicators and clones
Removable media (USB)
Camera
Labeling supplies
What are the 3 types of carving?
File based
Content
Header and footer
What is it called when a set of tools look at data in sections or block by block?
Carving
How can you validate files and images?
Hashing
Which hashing algorithm is used because it’s fast and available everywhere?
MD 5
Which hashing algorithm is used because it’s low risk
Sha-1
What is a method used by Linux to pull human readable text
Strings
What is it called when attackers use A method that makes code difficulty to read and is apart of a malware package?
Packers
What is built in forensics toolkits to look up similar information to compare?
Log viewers
What is wireShark’s nickname?
Packet sniffer
Which Linux utilities tools are used to sort and analyze packet data?
Topdump and prep
. What are disadvantages of using containers in forensics?
Don’t last long in the system
Designed to be disposable
May cause you to lose your forensic evidence
Name the 3 areas that are focused on in the post-incident Analysis phase?
Root cause analysis
Forensic analysis
Lessons learned
Is the post-incident analysis phase during or after the incident?
During (despite post means after)
Name the 2 output by using forensic analysis?.
Forensic analysis = x+y
Root cause
Lessons learned
Also known as litigation holds
Requires companies to hold onto (preserve) data for a set period of time
Legal holds
Describe in your own words what bit by bit copying means?
Everything is copied to include deleted files, old, old data that has not been overwritten and any leftover space
Which Linux utility command is used to clone drives for in raw format to ensure imaging is done right and quickly.
Dd utility
What information does a chain of custody include?
. What was collected
Who collected it
When it was collected
What devices were used
. What does using write blockers do for people like the FBI?
. Allows agents to clone the targeted drive to ensure no data is altered and all forensic evidence is collected
. Name the disadvantages live imaging
May leave leftover data from the imaging process
Contents may change
Malware may detect the imaging
Does not copy the unallocated space
What type of capture collects all of the systems before it shuts off because it will be lost
Memory capture
Which tools are used for memory capture
Dump it
F mem
Lime
Encase
FTK
What ave the 4 primary modes of data acquisition from a mobile device?
Physical- SIM card
Logical
Manual access- looking at all of the phone’s data if it’s unlocked
File system - looks at existing and deleted files
