Chapter 3 Flashcards
What is the term for the unused space between the logical end of file and the physical end of file on a disk?
File slack
What is the name of the principle that states that you cannot interact in an environment without leaving some trace?
Locard’s principle of transference
What is the purpose of the Federal Rules of Evidence (FRE)?
Both A and B
A - To govern the admission of facts in U.S. federal court cases
B - To provide guidelines for the authentication and identification of evidence
What does Rule 901 of the FRE require for the authentication or identification of an item of evidence?
A - Sufficient evidence to support a finding that the item is what the proponent claims it is
B - Testimony that an item is what it is claimed to be
What does Item 1 in the Federal Rules of Evidence (FRE) refer to?
Expert testimony
What is the significance of Item 9 in the FRE for computer forensics?
B - It emphasizes understanding how the tools work
C - It is critical for authenticating the process
What is the first step in collecting evidence according to the order of volatility?
Collecting data from registers and cache
What does volatility refer to in the context of digital forensics?
The ease with which data can change
What is RFC 3227?
A document that presents guidelines for evidence collection and archiving
What is the life span of information stored in computer memory?
1 millisecond
What are the six classes in the DFRWS framework?
Identification, Preservation, Collection, Examination, Analysis, Presentation
What are the primary phases of the Event-Based Digital Forensics Investigation Framework?
Readiness, Deployment, Physical Crime Scene Investigation, Digital Crime Scene Investigation, Presentation
Why is file slack a potential security risk?
It contains residual information that is not necessarily overwritten when a new file is created
What are the three basic tasks related to handling evidence for a system forensics specialist?
Finding, preserving, and preparing evidence
What is the first step in any forensic investigation?
Making a copy of the suspected storage device
What is an expert report?
A document that details the expert’s findings
A document that lists all items, documents, and evidence considered by the expert
A document that details tests performed, analysis done, and conclusions drawn by the expert
What is ISO/IEC 27037:2012?
It’s a standard for digital forensics.
What does ISO/IEC 27041:2015 provide guidance on?
Forensics methods and tools.
What organization has a Computer Forensics Tool Testing Program?
National Institute of Standards and Technology.
What is TEMPEST?
It’s a certification for equipment with EMR shielding.
What is EnCase?
A forensic toolkit from Guidance Software
What does EnCase use to verify the integrity of the entire disk image?
MD5 hash
What is Forensic Toolkit (FTK) particularly useful for?
Cracking passwords
What does FTK provide tools to search and analyze?
Windows Registry
What is the purpose of Helix (for Linux only) in computer forensics?
To perform analysis on a suspect system
What is one of the main functions of AnaDisk?
Analyzing disks for anomalies
