Chapter 6: Current Digital Forensics Tools

Question 1

Encryption

Answer 1

The process of converting information or data into a code, especially to prevent unauthorized access.

Question 2

reconstruction

Answer 2

Re-create a suspect drive to show what happened during a crime or an incident.

Question 3

acquisition

Answer 3

Making a copy of the original drive.

Question 4

brute-force attack

Answer 4

A trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys.

Question 5

Computer Forensics Tool Testing (CFTT)

Answer 5

Manages research on computer forensic tools.

Question 6

extraction keyword search

Answer 6

Text analysis technique that consists of automatically extracting the most important words and expressions in a text, speeds it up for investigators.

Question 7

National Software Reference Library (NSRL) password dictionary attack

Answer 7

Brute-force hacking method used to break into a password-protected computer or server by systematically entering every word in a dictionary as a password.

Question 8

Reconstruction

Answer 8

Recreate a suspect drive to show what happened during a crime or incident.

Question 9

validation

Answer 9

An automatic computer check to ensure that the data entered is sensible and reasonable. It does not check the accuracy of data.

Question 10

write-blocker

Answer 10

Prevents data writes to a hard disk.

Question 11

carving

Answer 11

The identification and extraction of file types from unallocated clusters using file signatures.

Question 12

purpose of the reconstruction function in a forensics investigation

Answer 12

To recreate image of a suspect drive.

Question 13

BitLocker

Answer 13

Full volume encryption feature included with Microsoft Windows (Pro and Enterprise only) versions starting with Windows Vista.

Question 14

the standard indicator for jpeg graphics files

Answer 14

FFD8

Question 15

Data copy sub-functions

Answer 15

Physical data copy, logical data copy, data acquisition format, command -line acquisition, GUI acquisition, remote, live, and memory acquisitions.

Question 16

Acquisition Function

Answer 16

Making a copy of the original drive.

Question 17

Goal of NSRL project

Answer 17

To use RDS to locate and identify known bad files.

Question 18

Raw data format

Answer 18

A collection of unprocessed data. This means the file has not been altered, compressed, or manipulated in any way by the computer.

Question 19

Verification

Answer 19

Proves that two sets of data are identical by calculating hash values or using another similar method.