Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Computer Crime > Chapter 7 > Flashcards

Chapter 7 Flashcards

1
Q

what is a vital source of digital evidence that historically has been neglected and ignored

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what does RAM stand for

A

random access memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what info does RAM contain

A
  • info about the current running state of the system before you shut it down
  • any running programs (legit AND malware)
  • info related to network connections the host has w other peers (legit peer-peer sharing AND attackers host)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

where would you look to find if a user has been sharing illicit images

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is the kitchen table of the computer system

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where may we only find evidence of data being hosted in the cloud

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

can you recover encryption keys for closed encryted containers that have been created by the user

A

sometimes through RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

if you were to take a forensic image of RAM at 2 diff times, what would you find

A

diff results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

are you changing evidence when you collect RAM

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

how is analyzing RAM diff from analyzing a hard drive

A
  • RAM is a snapshot of a live running system
  • hard drive examination is static
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

is storing on RAM quick

A

extremely fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

the data stored within RAM chips is considered to be _____

A

volatile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

when do we lose volatile data

A

when the computer system is no longer powered on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are the 2 diff types of RAM

A
  • static RAM (SRAM)
  • dynamic RAM (DRAM)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the differences between SRAM and DRAM

A
  • SRAM
  • faster
  • more efficient w respect to energy use
  • DRAM
  • cheaper to produce
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is SRAM and DRAM typically used for

A
  • SRAM cache memory for the CPU
  • DRAM used for memory chips for the computer system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what does ROM stand for

A

read-only memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what does ROM do

A
  • permanently stores data within the memory chips
  • NOT volatile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

for the CPU to access the data/execute code being stored in the memory chips, what must exist

A

a unique location identifier to that data (an address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is privilege separation

A
  • determines what a user, user account, the process is allowed to access
  • a form of access control
  • when used by the OS, helps provide system stability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

how does privilege separation provide system stability

A

isolates users and the CPU kernel’s actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is the other term for the OS’s trusted mode

A

kernel mode

23
Q

what is the other term for untrusted mode

A

user mode

24
Q

do different operating systems access RAM in different or the same general manners

A

the same

25
Q

in privilege separation, what modes does the OS and user applications operate in

A
  • OS trusted mode/ kernel mode
  • user application untrusted/ user mode
26
Q

what is system calls

A
  • a bridge between the application and OS to allow untrusted mode to become trusted for a specific instance
  • used when the user application needs to request access to resources controlled by the OS’s kernel
27
Q

what is process management

A
  • program code executed in memory
  • OS is responsible for managing the processes
28
Q

what is threads

A
  • the basic unit of using the system’s resources (like CPU)
29
Q

the contents of RAM may include artifacts of what is/has occurred such as…

A
  • configuration info
  • typed commands
  • passwords
  • encryption kets
  • unencrypted data
  • IP addresses
  • internet history
  • chat convo
  • emails
  • malware
30
Q

can you access RAM after the system has shut down

A
  • no
  • but you can examine other sources that may have the data that you’re looking for
31
Q

what are other sources that might have the same info as RAM

A
  • hibernation file
  • pagefile
  • swapfile
  • crash dump
32
Q

what is hibernation

A

the process of powering down the computer while still maintaining the current state of the system

33
Q

how do you get RAM info from hibernation

A
  • RAM will be compressed and stored in hiberfill.sys file
  • when the system is reactivated, the contents will be placed back in RAM
34
Q

how do you get RAM info from pagefile

A

the system will transfer data to pages, and hide away the least requested info

35
Q

what is paging

A

a method of storing/retrieving data being used in RAM chips w a virtual memory file on storage device

36
Q

what is swapfile

A
  • very similar to page file
  • when an application is suspended, the system will write the app data completely into the swap file
  • this frees up space
37
Q

what is crash dump

A

when the system crashes, it may create a dump of memory to store info about the state of the system at the time of the crash

38
Q

what are the diff kinds of crash dump and what do they mean

A
  • **complete memory dump* data contained within physical memory
  • kernel memory dump only pages of data in kernel mode
  • small dump files info about running processes/loaded divers at the time of crash
39
Q

what contains the key to determine which memory dumps may exist on the system you are examining

A

the SYSTEM hive

40
Q

the SWGDE has offered which considerations regarding the collection of volatile data

A
  • the app used to collect data will overwrite some memory content
  • the larger the tool/ files, more data is overwritten
  • the system may load the USB device drievr into memory or registry
  • the app used to collect the RAM data will show up in some most recently used (MRUs)
41
Q

to successfully image the RAM, what do you need

A
  1. a capturing device (such as a USB)
  2. access to the system
  3. administrator privileges
42
Q

what are some tools that can be used to capture RAM

A
  • DumpIt
  • FTK Imager
43
Q

what software should be used to analyze RAM

A

open source or commercial (depends on examiner’s preference)

44
Q

what are some open source software to analyze RAM

A
  • bulk extractor
  • volatility
  • VOLIX II v2
45
Q

describe Bulk Extractor

A
  • scans target media and extracts what it believes to be useful info
  • ignores filesystem structure, allowing it to process diff parts of source data
  • very fast
46
Q

describe Volix II

A
  • a GUI frontend for the volatility framework
  • quick search
47
Q
A

A and B

48
Q
A

C

49
Q
A

C

50
Q
A

C

51
Q
A

false

52
Q

is it acceptable to install DumpIt on the suspect computer

A

false

53
Q
A

Volatility

54
Q
A

Computer Crime (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions