Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Fornesics > Chapter 3 > Flashcards

Chapter 3 Flashcards

1
Q

What’s the main goal of a static acquisition?

A

to preserve the digital evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Name three formats of digital forensics acquisitions.

A

Raw Format, Proprietary Formats, Advance Forensic Format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are two advantages and disadvantages of the raw format?

A

fast data transfers and capability to ignore minor data read errors on the source drive, Requires as much storage space as the original disk or that it might not collect marginal (bad) sectors on the source drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

List two features common with proprietary format acquisition files.

A

to compress or not to compress, Capability to split an image into smaller segmented files, Capability to integrate metadata into the image file ( date and time, hash values).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Of all the proprietary formats, which one is the unofficial standard?

A

Expert Witness Format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive.

A

EnCase, SafeBack, and SnapCopy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does a logical acquisition collect for an investigation?

A

only specific files of interest to the case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does a sparse acquisition collect for an investigation?

A

fragments of unallocated data in addition to the logical allocated data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What should you consider when determining what data acquisition method to use?

A

size of the source drive, whether the source drive be retained as evidence, how long the acquisition will take, and where the disk evidence is located

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is it a good practice to make two images of a suspect drive in a critical investigation?

A

to ensure at least one good copy of the forensically collected data in case of any failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When you perform an acquisition at a remote location, what would you consider to prepare for this task?

A

determining whether there’s sufficient electrical power and lighting and checking the temperature and humidity at the location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

With newer Linux kernel distributions, what happens if you connect a hot-swappable device, such a USB drive, containing evidence?

A

Newer Linux distributions automatically mount the USB device, which could alter data on it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

n a Linux shell the fdisk -1 command lists the suspect drive as /dev/hda1. Is the following dcfldd command correct?
dcfldd if=image_file.img of=/dev/sha1.

A

False
The correct command is dcfldd if=/dev/hda1 of=image_file.img. If performing the other command without a write blocker could alter the data and thus remove that evidence from existence in a case if no write blocker was used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the most critical aspect of computer evidence?

A

validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a hashing algorithm?

A

A program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The Linux dcfldd command, which tree options are used for validation data?

A

hash=, hashlog=, and vf=

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What’s the maximum file size when writing data to a FAT32 drive?

A

2 GB (a limitation of FAT file systems)

18
Q

What are two concerns when acquiring data from a RAID server?

A

1) amount of data storage needed.
2) the type of RAID server (0, 1, 5, etc.)
3) whether your acquisition tool can handle RAID acquisitions.
4) whether your analysis tool can handle RAID data
5) whether your analysis tool can split RAID data into separate drives

19
Q

With remote acquisitions, what problems should you be aware of?

A

a. Data transfer speeds
b. Access permissions over the network
c. Antivirus, antispyware, and firewall programs

20
Q

How does ProDiscover Investigation encrypt the connection between the examiners and suspect’s computers?

A

ProDiscover provides 256-bit AES or Twofish encryption with GUID and encrypts the password on the suspect’s workstation.

21
Q

What is the ProDiscover remote access program?

A

PDServer

22
Q

Which computer forensics tools can connect to suspect’s remote computer and run surreptitiously?

A

EnCase Enterprise, ProDiscover Investigator, and ProDiscover Incident Response

23
Q

EnCase, FTK, SMART, and ILook treat an image file as though it were the original disk.

A

T

24
Q

FTK Imager can acquire data in a drive’s host protected area.

A

F

25
Q

Advanced Forensic Format (AFF)

A

An open-source data acquisition format that stores image data and metadata.

26
Q

An open-source data acquisition format that stores image data and metadata.

A

Advanced Forensic Format (AFF)

27
Q

host protected area (HPA)

A

An area of a disk drive reserved for booting utilities and diagnostic programs. It is not visible to the computer’s OS.

28
Q

An area of a disk drive reserved for booting utilities and diagnostic programs. It is not visible to the computer’s OS.

A

host protected area (HPA)

29
Q

live acquisitions

A

A data acquisition method used when a suspect computer can’t be shut down to perform a static acquisition.

30
Q

A data acquisition method used when a suspect computer can’t be shut down to perform a static acquisition.

A

live acquisitions

31
Q

Logical Acquisition

A

This data acquisition method captures only specific files of interest to the case or specific types of files.

32
Q

This data acquisition method captures only specific files of interest to the case or specific types of files.

A

Logical Acquisition

33
Q

raw format

A

A data acquisition format that creates simple sequential flat files of a suspect drive or data set

34
Q

A data acquisition format that creates simple sequential flat files of a suspect drive or data set

A

raw format

35
Q

redundant array of independent disks (RAID)

A

Two or more disks combined into one large drive in several configurations for special needs.

36
Q

Two or more disks combined into one large drive in several configurations for special needs.

A

redundant array of independent disks (RAID)

37
Q

sparse acquisition

A

This data acquisition method captures only specific files of interest to the case, but also collects fragments of unallocated (deleted) data.

38
Q

This data acquisition method captures only specific files of interest to the case, but also collects fragments of unallocated (deleted) data.

A

sparse acquisition

39
Q

Static Acquisitions

A

A data acquisition method used when a suspect drive is write-protected and can’t be altered.

40
Q

A data acquisition method used when a suspect drive is write-protected and can’t be altered.

A

Static Acquisitions

41
Q

Whole Disk Encryption

A

An encryption technique that performs a sector-by-sector encryption of an entire drive. Each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method.

42
Q

An encryption technique that performs a sector-by-sector encryption of an entire drive. Each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method.

A

Whole Disk Encryption

Digital Fornesics (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions