CHFI Assessment Flashcards
Scientific Working Group on Digital Evidence (SWGDE) has defined standards and criteria for the Exchange of Digital Evidence. Which of this SWGDE standards and criteria states that “Procedures used must be generally accepted in the field or supported by data gathered an recorded in a scientific manner”?
Standards and Criteria 1.3
Analysis is the process of interpreting the extracted data to determine their significance to the case. The result of which analysis may indicate the additional steps that need to be taken in the extraction and analysis processes?
Application and File Analysis
What is the smallest allocation unit of a hard disk, which contains a set of tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme?
Cluster
File system is a set of data types, which is employed for storage, hierarchical categorization, management, navigation, access, and recovering the data. What type of file system is the one in which a number of systems (servers) have access to the same external disk subsystem?
Shared Disk File Systems
Major file systems include FAT, NTFS, HFS, Ext2, Ext3, etc. Identify the correct statement for FAT file system:
Does not support file system recovery
Redundant Array of Inexpensive Disks (RAID) is a technology that uses multiple smaller disks simultaneously which functions as a single large volume. In what RAID level is disk mirroring done?
RAID Level 1
During live response, you can retrieve and analyze much of the information in the Registry, and the complete data during post-mortem investigation. Which registry Hive contains configuration information relating to which application is used to open various files on the system?
HKEY_CLASSES_ROOT
Registry keys that track user’s activities can be found in the NTUSER.DAT file. When a user performs a particular action, the registry keys Lastwrite time is updated. These registry keys track the user’s activity and add or modify timestamp information associated with the Registry values, this timestamp information is maintained in the value data. Important dates are available in the contents of the binary data for the F value such as time/date stamps, represented as 64-bit FILETIME objects. What does bytes 24-31 represent?
Represents the date that the password was last reset
FTP stands for File Transfer Protocol and an FTP server sends and receives files using FTP. What description does the FTP sc-status Error Code 1xx give?
Positive Preliminary Replies
Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media. The type of data acquisition which is defined as acquiring data that remains unaltered when the system is powered off or shutdown, is known as:
Static Acquisition
Forensic investigators use the built-in Linux command dd to copy data from a disk drive. The “dd” command can copy the data from any disk that Linux can mount and access. What is the syntax for copying one hard disk partition to another hard disk?
dd if=/dev/sda2 of=/dev/sdb2 bs=4096 conv=notrunc,noerror
EnCase Forensic provides a variety of software modules that put powerful investigative tools at the disposal of forensic investigators. What EnCase Forensic software module allows investigators to mount computer evidence as a local drive for examination through Windows Explorer?
Physical Disk Emulator (PDE)
An evidence case has a tripartite structure consisting of an evidence file, a case file, and EnCase configuration files. By defualt, a backup copy of the case file is saved every 10 minutes. What option can be used to disable the autosave function?
0
“EnCase has built-in capabilities to view all file types”. True/False
False
The file content of evidence files can be viewed using the View Pane. The View Pane provides several tabs to view file content. What tab provides native views of formats supported by Oracle outside in technology?
Doc tab
EnCase allows you to bookmark any content displayed in the View pane. Bookmarks are stored in their associated case file and can be viewed by selecting the Bookmarks tab. When does a file group bookmark get created?
If more than on file is selected in the Entries table.
What attack technique is the combination of both a brute-force attack and a dictionary attack to crack a password?
Syllable Attack
Wireless communication is the transfer of information between two or more points that are not physically connected. What wireless standard has the Bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz?
802.11a
It is essential to understand the laws that apply to the investigation including the internal organization policies before starting the investigation process. Identify Rule 901 of forensic laws:
Requirement of authentication or identification.
ETI investigation can be used to show that individuals commit crimes in furtherance of the criminal enterprise. What does ETI stand for?
Enterprise Theory of Investigation
A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media is referred to as computer forensics. The person who is responsible for authorization of a policy or procedure for the investigation process is referred to as what?
Decision Maker
What is a legal document that demonstrates the progression of evidence as it travels from original evidence location to the forensic laboratory?
Chain of Custody
Joh is a Forensic Investigator working for Rodridge Corp. He started investigating a forensic case and has collected some evidence. Now John wants to use this evidence for further analysis. What should John do?
He should not use the original evidence he has collected.
The digital evidence must have some characteristics to be disclosed in the court of law. The statement “Evidence must be related to the fact being proved”, defines what characteristic?
Admissible
Digital evidence is circumstantial, which makes it difficult for a forensics investigator to trace the system’s activity. Identify the nature of digital evidence:
Fragile
Digital evidence is defined as “any information of probative value that is either stored or transmitted in a digital form”. What type of digital data contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, and command history?
Volatile data
What type of digital data is used for the secondary storage and is long-term persisting?
Non-volatile Data
What type of digital data stores a document file on a computer when it is deleted and helps in the process of retrieving the file until that file space is reused?
Residual Data
Rules of evidence govern whether, when, how, and for what purpose proof of a case may be placed before a trier of fact for consideration. In Federal Rules of Evidence, what rule is for Admissibility of Duplicates?
Rule 1003
Different types of electronic devices are used for collecting potential evidence to investigate a forensic case. In which electronic device evidence is found through Address book, Notes, Appointment calendars, Phone numbers and Email?
Digital Watches
“Under no circumstances should anyone, with the exception of qualified computer forensic personnel, make any attempts to restore or recover information from a computer system or device that hold electronic information”. This statement is valid for what rule?
First response rule
When collecting evidence, the collection should proceed from the most volatile to the least volatile. From the given list, identify which one of the following is least volatile.
Archival media.
Mike is a Computer Forensic Investigator. He got a task from an organization to investigate a forensic case. When Mike reached the organization to investigate the place, he found that the computer at the crime scene was switched off. In this scenario, what do you think Mike should do?
He should leave the computer off.
In Forensic Investigation all evidence collected should be marked as exhibits using the exhibit numbering format. The format of exhibit numbering is aaa/ddmmyy/nnnn/zz. What is the zz in the exhibit number format?
The sequence number for part of the same exhibit
A Computer Forensic Lab (CFL) is a designated location for conducting computer based investigation on collected evidence. Identify which one of the following is not a good consideration for the structural design of forensic lab.
It must have windows in the mat exteriro
The study of equipment to meet the human requirements of comfort without affecting the efficiency is defined as:
Ersonci
Platters are the round flat magnetic metal or ceramic disks in the hard disk that hold the actual data. A concentric circular ring on both sides of each platter is known as a track. Track numbering starts from which number?
0
Booting refers to the process of starting or resetting operating systems when the user turns on a computer system. Cold boot is a type of booting, and is defined as the process of starting a computer from a power-down or off state.
Hard Boot
What information can be easily modified or lost when the system is shut down or rebooted?
Volatile information
