CHFI Assessment Flashcards
Scientific Working Group on Digital Evidence (SWGDE) has defined standards and criteria for the Exchange of Digital Evidence. Which of this SWGDE standards and criteria states that “Procedures used must be generally accepted in the field or supported by data gathered an recorded in a scientific manner”?
Standards and Criteria 1.3
Analysis is the process of interpreting the extracted data to determine their significance to the case. The result of which analysis may indicate the additional steps that need to be taken in the extraction and analysis processes?
Application and File Analysis
What is the smallest allocation unit of a hard disk, which contains a set of tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme?
Cluster
File system is a set of data types, which is employed for storage, hierarchical categorization, management, navigation, access, and recovering the data. What type of file system is the one in which a number of systems (servers) have access to the same external disk subsystem?
Shared Disk File Systems
Major file systems include FAT, NTFS, HFS, Ext2, Ext3, etc. Identify the correct statement for FAT file system:
Does not support file system recovery
Redundant Array of Inexpensive Disks (RAID) is a technology that uses multiple smaller disks simultaneously which functions as a single large volume. In what RAID level is disk mirroring done?
RAID Level 1
During live response, you can retrieve and analyze much of the information in the Registry, and the complete data during post-mortem investigation. Which registry Hive contains configuration information relating to which application is used to open various files on the system?
HKEY_CLASSES_ROOT
Registry keys that track user’s activities can be found in the NTUSER.DAT file. When a user performs a particular action, the registry keys Lastwrite time is updated. These registry keys track the user’s activity and add or modify timestamp information associated with the Registry values, this timestamp information is maintained in the value data. Important dates are available in the contents of the binary data for the F value such as time/date stamps, represented as 64-bit FILETIME objects. What does bytes 24-31 represent?
Represents the date that the password was last reset
FTP stands for File Transfer Protocol and an FTP server sends and receives files using FTP. What description does the FTP sc-status Error Code 1xx give?
Positive Preliminary Replies
Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media. The type of data acquisition which is defined as acquiring data that remains unaltered when the system is powered off or shutdown, is known as:
Static Acquisition
Forensic investigators use the built-in Linux command dd to copy data from a disk drive. The “dd” command can copy the data from any disk that Linux can mount and access. What is the syntax for copying one hard disk partition to another hard disk?
dd if=/dev/sda2 of=/dev/sdb2 bs=4096 conv=notrunc,noerror
EnCase Forensic provides a variety of software modules that put powerful investigative tools at the disposal of forensic investigators. What EnCase Forensic software module allows investigators to mount computer evidence as a local drive for examination through Windows Explorer?
Physical Disk Emulator (PDE)
An evidence case has a tripartite structure consisting of an evidence file, a case file, and EnCase configuration files. By defualt, a backup copy of the case file is saved every 10 minutes. What option can be used to disable the autosave function?
0
“EnCase has built-in capabilities to view all file types”. True/False
False
The file content of evidence files can be viewed using the View Pane. The View Pane provides several tabs to view file content. What tab provides native views of formats supported by Oracle outside in technology?
Doc tab
EnCase allows you to bookmark any content displayed in the View pane. Bookmarks are stored in their associated case file and can be viewed by selecting the Bookmarks tab. When does a file group bookmark get created?
If more than on file is selected in the Entries table.
What attack technique is the combination of both a brute-force attack and a dictionary attack to crack a password?
Syllable Attack
Wireless communication is the transfer of information between two or more points that are not physically connected. What wireless standard has the Bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz?
802.11a
It is essential to understand the laws that apply to the investigation including the internal organization policies before starting the investigation process. Identify Rule 901 of forensic laws:
Requirement of authentication or identification.
ETI investigation can be used to show that individuals commit crimes in furtherance of the criminal enterprise. What does ETI stand for?
Enterprise Theory of Investigation
A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media is referred to as computer forensics. The person who is responsible for authorization of a policy or procedure for the investigation process is referred to as what?
Decision Maker
What is a legal document that demonstrates the progression of evidence as it travels from original evidence location to the forensic laboratory?
Chain of Custody
Joh is a Forensic Investigator working for Rodridge Corp. He started investigating a forensic case and has collected some evidence. Now John wants to use this evidence for further analysis. What should John do?
He should not use the original evidence he has collected.
The digital evidence must have some characteristics to be disclosed in the court of law. The statement “Evidence must be related to the fact being proved”, defines what characteristic?
Admissible
