Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Computer Crime > Chapter 7 > Flashcards

Chapter 7 Flashcards

1
Q

what is a vital source of digital evidence that historically has been neglected and ignored

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what does RAM stand for

A

random access memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what info does RAM contain

A
  • info about the current running state of the system before you shut it down
  • any running programs (legit AND malware)
  • info related to network connections the host has w other peers (legit peer-peer sharing AND attackers host)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

where would you look to find if a user has been sharing illicit images

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is the kitchen table of the computer system

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where may we only find evidence of data being hosted in the cloud

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

can you recover encryption keys for closed encryted containers that have been created by the user

A

sometimes through RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

if you were to take a forensic image of RAM at 2 diff times, what would you find

A

diff results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

are you changing evidence when you collect RAM

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

how is analyzing RAM diff from analyzing a hard drive

A
  • RAM is a snapshot of a live running system
  • hard drive examination is static
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

is storing on RAM quick

A

extremely fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

the data stored within RAM chips is considered to be _____

A

volatile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

when do we lose volatile data

A

when the computer system is no longer powered on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are the 2 diff types of RAM

A
  • static RAM (SRAM)
  • dynamic RAM (DRAM)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the differences between SRAM and DRAM

A
  • SRAM
  • faster
  • more efficient w respect to energy use
  • DRAM
  • cheaper to produce
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is SRAM and DRAM typically used for

A
  • SRAM cache memory for the CPU
  • DRAM used for memory chips for the computer system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what does ROM stand for

A

read-only memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what does ROM do

A
  • permanently stores data within the memory chips
  • NOT volatile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

for the CPU to access the data/execute code being stored in the memory chips, what must exist

A

a unique location identifier to that data (an address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is privilege separation

A
  • determines what a user, user account, the process is allowed to access
  • a form of access control
  • when used by the OS, helps provide system stability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

how does privilege separation provide system stability

A

isolates users and the CPU kernel’s actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is the other term for the OS’s trusted mode

A

kernel mode

23
Q

what is the other term for untrusted mode

24
Q

do different operating systems access RAM in different or the same general manners

25
in privilege separation, what modes does the OS and user applications operate in
- **OS** trusted mode/ kernel mode - **user application** untrusted/ user mode
26
what is system calls
- a bridge between the application and OS to allow untrusted mode to become trusted for a specific instance - used when the user application needs to request access to resources controlled by the OS's kernel
27
what is process management
- program code executed in memory - OS is responsible for managing the processes
28
what is threads
- the basic unit of using the system's resources (like CPU)
29
the contents of RAM may include artifacts of what is/has occurred such as...
- configuration info - typed commands - passwords - encryption kets - unencrypted data - IP addresses - internet history - chat convo - emails - malware
30
can you access RAM after the system has shut down
- no - but you can examine other sources that may have the data that you're looking for
31
what are other sources that might have the same info as RAM
- hibernation file - pagefile - swapfile - crash dump
32
what is hibernation
the process of powering down the computer while still maintaining the current state of the system
33
how do you get RAM info from hibernation
- RAM will be compressed and stored in hiberfill.sys file - when the system is reactivated, the contents will be placed back in RAM
34
how do you get RAM info from pagefile
the system will transfer data to pages, and hide away the least requested info
35
what is paging
a method of storing/retrieving data being used in RAM chips w a virtual memory file on storage device
36
what is swapfile
- very similar to page file - when an application is suspended, the system will write the app data completely into the swap file - this frees up space
37
what is crash dump
when the system crashes, it may create a dump of memory to store info about the state of the system at the time of the crash
38
what are the diff kinds of crash dump and what do they mean
- **complete memory dump* data contained within physical memory - **kernel memory dump** only pages of data in kernel mode - **small dump files** info about running processes/loaded divers at the time of crash
39
what contains the key to determine which memory dumps may exist on the system you are examining
the SYSTEM hive
40
the SWGDE has offered which considerations regarding the collection of volatile data
- the app used to collect data will overwrite some memory content - the larger the tool/ files, more data is overwritten - the system may load the USB device drievr into memory or registry - the app used to collect the RAM data will show up in some *most recently used* (MRUs)
41
to successfully image the RAM, what do you need
1. a capturing device (such as a USB) 2. access to the system 3. administrator privileges
42
what are some tools that can be used to capture RAM
- DumpIt - FTK Imager
43
what software should be used to analyze RAM
open source or commercial (depends on examiner's preference)
44
what are some open source software to analyze RAM
- bulk extractor - volatility - VOLIX II v2
45
describe Bulk Extractor
- scans target media and extracts what it believes to be useful info - ignores filesystem structure, allowing it to process diff parts of source data - very fast
46
describe Volix II
- a GUI frontend for the volatility framework - quick search
47
A and B
48
C
49
C
50
C
51
false
52
is it acceptable to install DumpIt on the suspect computer
false
53
Volatility
54

Computer Crime (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions