Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Study Notes 3rd Year > COIS 2750 > Flashcards

COIS 2750 Flashcards

1
Q

What will directly impact your ability to write effective report

A

Your ability to take notes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What will be your foundation for reporting

A

Your notes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

4 fundamental elements of note taking

A

what you did
what you saw
when you did something
why did you do it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

General template for your notes

A

Administrative info
Executive summary
Narrative
Exhibits/technical details
Glossary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the keys to the change in browser history

A

user experience, security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what does the history database contain on chrome

A

Downloads, history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do cookies do

A

Cookies are designed to track the user’s activity, such as adding an item to a shopping cart or recording the pages the user has visited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or False: A cookie is conclusive evidence that the user has accessed a website

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What format are internet explorer bookmarks in

A

URL format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are internet explorer bookmarks found in

A

Favourites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

5 types of subscriber information

A

name, address, age, usage dates/times, and IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does P2P filesharing work

A

When the user searches the P2P network and finds a file they wish to download, the application will identify all the nodes possessing that file. The application will then connect to the nodes and start downloading pieces of the file from all the available nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

3 types of cloud based computing

A

Iaas - Infrastructure as a service
Saas - software as a service
Paas - Platform as a service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Saas

A

Applications are provided to the customer via the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Iaas

A

The remote infrastructure is offered to the customer for use, while the provider maintains ownership and control of the hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Paas

A

The operating system of the client is provided to the customer via a cloud server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

2 files found in dropbox

A

filecahce
config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what does config.dbx contain

A

Contains the user ID, account email address, account username, and path for the dropbox folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what does filecache.dbx contain

A

consist of the filename, file path, and file size in the local host ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

3 files in google drive

A

sync_config.db
snapshot.db
device_db.db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what does sync_config.db contain

A

Contains the path, show if USB devices are being synced, and the email account associated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what does snapshot.db contian

A

include the serial number of the volume, filename, modified date/time stamps, file size, and show if it is a file or a folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what does device_db.db contain

A

will contain the device ID of the USB device, the file name of the synced file, the file path, and the date/time stamp of when the file was synchronized to cloud-based storage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an email protocol

A

An email protocol is a standard that is used to allow two computer hosts to exchange email communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Where does an email go once it is sent

A

When an email is sent it travels from the senders host to an email server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the standardized protocol that allows users to access their inbox and download emails

A

POP3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is IMAP

A

Internet message access protocol

Standard protocol used by an email client to access emails on an email server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the most significant difference between IMAP and POP3

A

The most significant difference between IMAP and POP is that POP retrieves the contents of the mailbox and IMAP was designed as a remote access mailbox protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Webmail providers

A

Gmail, Yahoo, Outlook, Hotmail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What do emails do on web based email

A

User deleted emails stored on a web-based email server typically remain on the server until the system deletes them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

2 unique factors of emails

A

domain name, along with the message ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does it mean when you come across emails with the same message id

A

The email server is not compliant with the standard
The user has altered the email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does this message ID mean 20080719233957

A

2008/july 19th/ at 11:39:57pm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the first thing an email touches

A

The received line is the first server the email touched

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Where do undeliverable emails go

A

The return-path-field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is MIME

A

Multipurpose Internet Mail Extensions

the internet standard for allowing emails to accept text other than ASCII, binary attachments, multi-part message bodies and non-ASCII base header information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

PART is the file starter for what

A

MIME extensions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Outlook stores files in what types

A

pst, mbd, or ost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Thunderbird or Mozilla stores files in what format

A

.MBOX file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

what are MSF files

A

Mail summary files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is RAM

A

Random access memory

contain info about the current running state of the system before you shut it down

snapshot of a live running system, whereas a hard drive examination is static.

RAM is much more transient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the downfall to collecting RAM

A

Capturing the data in RAM will lead to the loss of potential evidence. You are changing evidence when you collect RAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

True or false: Data can be written on RAM at extremely fast speeds

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What tactic is no longer recommended in digital investigations

A

“pull the plug tactic”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are the two types of RAM

A

Dynamic ram (Dram) and Static ram (Sram)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the difference between Dram and Sram

A

SRAm is faster and more efficient than DRAM
DRAM is cheaper to produce
You will typically find SRAM being used as cache memory for the CPU
DRAM chips being used for memory chips for the computer system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What size is data stored in RAM

A

4KB pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is privilege seperation

A

Privilege determines what a user, user account, and the process is allowed to access. It is a form of access control and when used by the operating system, it helps provide system stability by isolating users and the CPU kernel’s actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is a system call

A

It is a bridge between the application and the operating system to allow the untrusted mode to become trusted for a specific instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is a thread

A

It is the basic unit of using the system’s resources, such as CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What contents can you find on RAM

A

artifacts of what is or has occurred on the system

Configuration information, Typed commands, Passwords, Encryption keys, Unencrypted data, IP addresses, Internet history, Chat conversations, Emails, Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is hiberfill.sys

A

Hibernation file

Hibernation is the process of powering down the computer while still maintaining the current state of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is pagefile.sys

A

Pagefile

Paging is a method of storing/retrieving data being used in the RAM chips with a virtual memory file stored on a traditional storage device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is swapfile.sys

A

Swapfile

When the application is suspended, the system will write the application data in its entirety into the swap file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

what is memory.dmp

A

Crash Dump

Happens when the system crashes
When that occurs, it may create a dump of memory to store information about the state of the system at the time of the crash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

3 types of crash dumps

A

complete memory dump
kernel memory dump
small dump files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

what is a complete memory dump

A

The data contained within the physical memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

what is a kernel memory dump

A

Will only contain pages of data that were in kernel mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

what are small dump files

A

Contains information about running processes/loaded drivers at the time of the crash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is SWGDE

A

The Scientific Workgroup on Digital Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

5 considerations when collecting volatile data

A

The application used to collect the data in memory will overwrite some contents of the memory.

The larger the tool and associated files are, the more data it overwrites.

The system may load the USB device driver into memory.

The system may load the USB device driver into the registry.

The application that’s used to collect the data in memory will show up in some Most Recently Used (MRUs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

3 things needed to capture RAM

A

A capturing device (such as a USB device)
Access to the system
Administrator privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What should your external device be formatted as when removing RAM

A

Your device should be formatted as an NTFS partition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What happens when a user first logs into a system

A

When the user first logs into the system, it will create a user profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What will each user profile have

A

a registry hive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What does the registry hive contain

A

users preferences and configuration settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

4 types of user profiles

A

Local
roaming
mandatory
temporary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a Local user profile

A

This profile is created when the user logs on to a computer for the first time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is a roaming user profile

A

This profile is an administrator-created, network-based profile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a mandatory user profile

A

This profile is a profile created by the network administrators to lock users down to a specific set of settings when they use a host on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is a temporary user profile

A

This profile is created when an error occurs when the system is loading the user’s profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

what are the 4 hive files

A

SAM
SECURITY
SOFTWARE
SYSTEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What is the SAM hive file

A

The SAM hive is the Security Accounts Manager and contains login information about the users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is the SECURITY hive file

A

The SECURITY hive contains security information and, potentially, password information.

75
Q

What is the SOFTWARE hive file

A

The SOFTWARE hive contains information about application information and the default Windows settings.

76
Q

what is the SYSTEM hive file

A

The SYSTEM hive includes information on the hardware and system configuration

77
Q

What is the NTUser.dat and what does it contain

A

An additional hive file which is stored in the root of the user profile
This contains information about the user behavior and their settings

78
Q

What is GUI

A

Graphical user interface

79
Q

what is a SID

A

Security identifier

80
Q

what is an RID

A

Relative identifier

81
Q

What are the three categories windows categorizes its events into

A

System: Information generated by the windows operating system
Application: Information generated by applications on the local machine
Security: Information related to login attempts

82
Q

What are some things you will get from event IDs

A

Th euser account had a successful login
The user account failed to log in
The user account successfully logged off from the local host
The user account had a successful login using explicit credentials; for example the command was run as
The user account had a successful login with elevated permissions
The user successfully created a user account

83
Q

What is a thumbcache

A

is a database of thumbnail images cereated when the user is using windows explorer in a thumbnail view

84
Q

What is an MRU and where is it found

A

Most recently used
a list of recently used files that are stored in the users NTUSER.DAT hive

85
Q

What is the goal of the recycle bin

A

effort to protect the user form their own actions

86
Q

What is a jumplist

A

It allows the user to access frequently used/recently used files from the windows taskbar

87
Q

What are the two types of jumplists

A

Automatic - system created. Records information about file usage
Custom - application-created. Records task-specific information about the application

88
Q

What are shellbags

A

a set of registry keys that remember the size and location of the folders and libraries that the user has accessed via the GUI

89
Q

What is prefetch

A

a feature microsoft introduced to enhance the user experience with the windows operating system by making faster response times to preloading data

stored in %WINDOWS%\PREFETCH

90
Q

4 things codes tell you

A

Whether there is a wireless network association
Whether there is a connection to a wireless network
Whether there is a failed connection to a wireless network
When the system is disconnected from a wireless network

91
Q

What is the shimcache and what information is stored in it

A

is used to track compatibility issues with executed programs

File Path
$Standard information attribute modify time
The update time of the shimcache

92
Q

Issues with USB devices

A

can be used to exfiltrate data from one organization

they can be used to deliver malware to an organization to compromise its security protocols

93
Q

Where do you find registry files

A

%SystemRoot%\System32\Config

94
Q

When examining log files, which event ID identifies successful logon

A

4672

95
Q

True or false: The mere presence of the artifact is a sign of a suspect’s guilt or innocence

A

False

We cannot construe the mere presence of the artifact as a sign of a suspect’s guilt or innocence
The artifact needs to be placed within the context of the user and system activity

96
Q

3 issues with MAC times

A

These may not be accurate
A third party user can use a third-party tool to change the timestamps
Moving files from one volume to another alters timestamps

97
Q

True or False: Hard-drive capacity is getting smaller

A

FALSE
Hard drive capacity is not getting smaller, in fact it is increasing at a phenomenal rate

98
Q

Examples of forensic suites used for timeline analysis

A

X Ways
Belkasoft
Autopsy
Recon Lab
Paladin

99
Q

What is plaso

A

Is a python backend and framework for the logtimeline forensic tool that pulls out timestamps from a system and creates a database of all events known as a super timeline

100
Q

What does the image_export command do

A

Image export will export file content from a device, media image, or forensic image

101
Q

What does the log2timeline command do

A

CLI tool that is designed to extract chronological-based events from files, directories, forensic images or devices
It will create a database file that can then be analyzed by a variety of tools

102
Q

What does the pinfo command do

A

Command line that is used to display information about the plaso database file

103
Q

What does the psort command do

A

CLI tool that allows you to filter, sort, and conduct analysis on the contents of the plaso database file

104
Q

What does the psteal command do

A

This process also allows for filtering tagging and analysis.

105
Q

What is an ELK stack

A

Elasticsearch is the search and analytical engine. Logstash is the data processor and ingest engine, while Kibana is the visualizer

106
Q

What is TimeLineMakerPro

A

It is a commercial product specifically designed for creating timeline charts.

107
Q

What is Aeon timeline

A

It is a commercial product specifically designed for creating visual timelines.

108
Q

What is Timeline Explorer

A

Timeline Explorer is an open source platform created by Eric Zimmerman, who wanted a tool to read MAC time and plaso-generated CSV files without the need to use Microsoft Excel

109
Q

What is allocated space

A

This is the space on the storage device that a file occupies. The filesystem recognizes the storage space as being used.

110
Q

What is unallocated space

A

This is the space on the storage device that is not occupied by a file

111
Q

what is slack space

A

When the data is stored in a cluster; if the file does not completely fill a cluster, the remaining space not used by the file is referred to as slack space

The space between the end of a logical file and the cluster boundary is called the file slack

112
Q

what are bad blocks

A

This is the space on the disk that has been marked bad by the filesystem because of a defect. It can also be used by a user to hide data from a casual inspection

113
Q

what is the Brian Carrier progression of media analysis

A

Disk, volume, filesystem, data unit, metadata

114
Q

Why was unicode developed

A

was developed to overcome the limitations of ASCII

115
Q

What is ROM

A

read-only memory

116
Q

It is widespread practise to remove what to create a forensic image

A

It is a widespread practice to remove the hard drive from the system to create a forensic image

117
Q

what does the C drive belong to

A

C drive belongs ot the logical partition of the hard drive

118
Q

What makes up the interior hard drive

A

One or more platters stacked together with a spindle in the center to read and write data
Platters which are made of metal alloy or glass, are coated with a magnetic substance in which the heads magnetically encode information on the platters
The heads can write data on both sides of the platter
Actuators that control the heads

119
Q

What are SSD’s

A

are storage devices that contain no moving parts. Instead, they are made up of memory chips.

120
Q

3 operations controlled by the firmware of SSD’s

A

Wear leveling
Trim
Garbage collection

121
Q

What is wear leveling

A

This spreads the writes across the different chips so that it uses the chips at the same rate.

122
Q

What is trim in regards to SSD’s

A

This will wipe the unallocated space of the device.

123
Q

What is garbage collection in regard to SSD’s

A

As the firmware scans the memory modules, it may identify pages within the data blocks that have been deleted. The firmware will move the allocated pages to a new block and will wipe the data block so that it can reuse the blocks. The firmware can only delete data in blocks.

124
Q

What is drive geometry

A

defines the number of heads, the number of tracks, cylinders, and the sectors per track

125
Q

What is the smallest storage unit on the device

A

A sector (B)

126
Q

What is partitioning

A

occurs when we divide the physical device into logical segments called “volumes”

127
Q

What was used to get around the partition limit

A

Extended partition

128
Q

What is the partition limit

A

4

129
Q

What is the FAT filesystem and what is the purpose

A

File Allocation Table
The purpose of the file allocation table is to track the clusters and to track which files will occupy the clusters

130
Q

What is arguably the most important filesystem

A

NTFS filesystem

New technology filesystem

131
Q

Evidence is a determination of the ____

A

trier of fact

132
Q

3 things that make a forensically sound environment

A

Digital forensic examiner controls the working environment of the digital forensic examination

No actions will occur unless the digital forensic examiner intends the action to occur

When the action has been completed, the examiner will reasonably know what the expected outcome is

133
Q

If an investigator cannot explaining the process of how a file system processes then _____

A

the testifying will be unsuccessful

134
Q

4 ways to mitigate attacks on your process

A

Understand their functionality
Document your training
Take notes during the exam
Validate the tools

135
Q

We must use what to prevent the alteration of the source device

A

We must use a write blocker.

136
Q

2 types of write-blockers

A

hard ware writeblocker
software writeblocker

137
Q

What does a hardware writeblocker do

A

a device that intercepts and prevents any modification to the source device.

138
Q

What does a software write blocker do

A

where a change is made to the operating system to stop it from making writes to the device.

139
Q

Whata re the two options when mounting a device

A

Read-only
Read/write

140
Q

True or false: you should conduct your examination on the original evidence

A

FALSE you should always make a copy

141
Q

What is a forensic copy

A

This is a straight bit-for-bit copy of the source to the destination.
We will recover deleted files, file slack, and partition slack.

142
Q

what is a forensic image

A

We are creating a bit-for-bit copy of the source device, but we store that data in a forensic image format.
We will recover deleted files, file slack, and partition slack.

143
Q

What is a logical forensic image

A

Due to this, we can make logical copies of the files and folders pertinent to the investigation. We will NOT be able to recover deleted files, file slack, and partition slack.

144
Q

5 subsets of the forensic analysis process

A

Pre-investigation considerations
Understanding case information and legal issues
Understanding data acquisition
Understanding the analysis process
Reporting your findings

145
Q

What are a few things that should be in your response kit

A

gloves, computer, notepad, paperwork, toolkit, camera

146
Q

open source software

A

free for anyone to use
Use for educational, profit, or testing purposes
often CLI or GUI

147
Q

Commercial software

A

paid for
more technical support

148
Q

Daubert standards

A

Whether the theory or technique can be or has been tested
Whether it has been subjected to peer review and publication
The known or potential error rate
The existence and maintenance of standards
Its acceptance within the scientific community

149
Q

Examples of open source forensic tools

A

CAINE
SIFT
Autopsy
Paladin

150
Q

Examples of commerical software

A

X-Ways Forensics
EnCase
Forensic Toolkit (FTK)
Forensic Explorer (FEX)
Belkasoft Evidence Center
Axinom

151
Q

Examples of organizations that provide training

A

International Association of Computer INvestigative Specialists(IACIS)
EnCase Certified Examiner (EnCE)
Accessdata Certified Examiner (ACE)
Computer Hacking Forensic INvestigator (CHFI)
Global Information Assurance Certification (GIAC)

152
Q

Order of volatility (most to least)

A

Live system
Running
Network
Virtual
Physical

153
Q

What does forensically sound manner mean

A

means leaving the smallest possible footprint during collection to minimize the amount of data being changed within collection

154
Q

What is encryption

A

encryption is encoding information to protect the confidentiality of the information and allow only the person with the decryption key to access it.

155
Q

4 things a chain of custody contains

A

Description of evidence
item number
quantity
description of item

156
Q

What time must you set all of your tools in to account for time zone issues

A

Universal time (UTC) as a standard frame reference helps solve this problem.

157
Q

What is a hash

A

A hash is a digital fingerprint for a file or piece of digital media.

158
Q

What are the standard cryptographic algorithms used in digital forensics for hash analysis

A

MD5 and SHA-1

159
Q

3 ways hash analysis can save time in investigations

A

You can use it to verify the evidence has not changed
It can be used to exclude files
It can be used to identify files of interest

160
Q

What is a collision

A

occurs when two different variable inputs result in the same fixed-length output

161
Q

What does file signature analysis do

A

Ensures the file extension matches the file type

162
Q

What is digital forensics

A

It is a division of forensics involving the recovery and analysis of data that has been recovered from digital devices.

163
Q

Most basic positions in forensics

A

First responder
Scene technician
Investigator

164
Q

Two groups of investigators

A

sworn unsworn

165
Q

What is a sworn officer

A

May take an oath to support the laws in their jurisdiction; they have the power to make arrests and carry firearms.

166
Q

What is an unsworn officer

A

May take an oath but do not have powers to arrest. These positions are typically crime scene analyst or law enforcement support technicians

167
Q

What will first responders identify

A

Potential victims
Witnesses
Potential suspects
How best to maintain control

168
Q

What does an investigator do when they arrive

A

Take control of the scene

169
Q

Before the government can seize information and evidence what must be obtained

A

A search warrant obtained
Or the consent of the owner

170
Q

IN order to obtain a search warrant you must have _____ ______

A

probable cause

171
Q

5 potential crimes in digital forensics

A

Stalking
p2p filesharing
Illicit images
Email based communications
newsgroups USEnet

172
Q

What is binary

A

a file type-digital images, videos, audio software or any other file type

USEnet file

173
Q

What is criminal conspiracy

A

A conspiracy occurs when two or more people agree to commit an illegal act
Just an agreement is not enough, there must be actions that carry out the plan

174
Q

What is a policy

A

Statement from the organization addressing a specific issue

175
Q

What is a procedure

A

Specific instructions regarding how to accomplish the goals of the policy

176
Q

Golden rule in digital forensics

A

Treat every investigation as if you will go to court for it

177
Q

What is corporate espionage

A

One organization spying on another organization to achieve commercial or financial gain

178
Q

What is a hacker

A

A hacker is a malicious user gaining access to information systems that belong to another

179
Q

What is a black hat

A

Someone who attacks a system with malicious intent
Goal is to violate and exploit the user information

180
Q

what is a white hat

A

Positive hacker, no malicious intent
Intent is to identify vulnerabilities in the system so the owner can help to fix them

181
Q

What is phishing

A

Attacker attempts to trick user into gaining access to confidential information such as username or passwords

182
Q

2 facts about insider threats

A

Insider threats are more dangerous than outsider threats
They take up 1/3 of digital forensic investigations

183
Q

What is required in the US to get subscriber information

A

A subpoena

Study Notes 3rd Year (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions