COIS 2750 Flashcards
1
Q
What will directly impact your ability to write effective report
A
Your ability to take notes
2
Q
What will be your foundation for reporting
A
Your notes
3
Q
4 fundamental elements of note taking
A
what you did
what you saw
when you did something
why did you do it
4
Q
General template for your notes
A
Administrative info
Executive summary
Narrative
Exhibits/technical details
Glossary
5
Q
What are the keys to the change in browser history
A
user experience, security
6
Q
what does the history database contain on chrome
A
Downloads, history
7
Q
What do cookies do
A
Cookies are designed to track the user’s activity, such as adding an item to a shopping cart or recording the pages the user has visited.
8
Q
True or False: A cookie is conclusive evidence that the user has accessed a website
A
False
9
Q
What format are internet explorer bookmarks in
A
URL format
10
Q
What are internet explorer bookmarks found in
A
Favourites
11
Q
5 types of subscriber information
A
name, address, age, usage dates/times, and IP addresses
12
Q
How does P2P filesharing work
A
When the user searches the P2P network and finds a file they wish to download, the application will identify all the nodes possessing that file. The application will then connect to the nodes and start downloading pieces of the file from all the available nodes
13
Q
3 types of cloud based computing
A
Iaas - Infrastructure as a service
Saas - software as a service
Paas - Platform as a service
14
Q
Saas
A
Applications are provided to the customer via the network
15
Q
Iaas
A
The remote infrastructure is offered to the customer for use, while the provider maintains ownership and control of the hardware.
16
Q
Paas
A
The operating system of the client is provided to the customer via a cloud server.
17
Q
2 files found in dropbox
A
filecahce
config
18
Q
what does config.dbx contain
A
Contains the user ID, account email address, account username, and path for the dropbox folder
19
Q
what does filecache.dbx contain
A
consist of the filename, file path, and file size in the local host ID
20
Q
3 files in google drive
A
sync_config.db
snapshot.db
device_db.db
21
Q
what does sync_config.db contain
A
Contains the path, show if USB devices are being synced, and the email account associated
22
Q
what does snapshot.db contian
A
include the serial number of the volume, filename, modified date/time stamps, file size, and show if it is a file or a folder
23
Q
what does device_db.db contain
A
will contain the device ID of the USB device, the file name of the synced file, the file path, and the date/time stamp of when the file was synchronized to cloud-based storage.
24
Q
What is an email protocol
A
An email protocol is a standard that is used to allow two computer hosts to exchange email communication
25
Where does an email go once it is sent
When an email is sent it travels from the senders host to an email server
26
What is the standardized protocol that allows users to access their inbox and download emails
POP3
27
What is IMAP
Internet message access protocol
Standard protocol used by an email client to access emails on an email server
28
What is the most significant difference between IMAP and POP3
The most significant difference between IMAP and POP is that POP retrieves the contents of the mailbox and IMAP was designed as a remote access mailbox protocol
29
Webmail providers
Gmail, Yahoo, Outlook, Hotmail
30
What do emails do on web based email
User deleted emails stored on a web-based email server typically remain on the server until the system deletes them
31
2 unique factors of emails
domain name, along with the message ID
32
What does it mean when you come across emails with the same message id
The email server is not compliant with the standard
The user has altered the email
33
What does this message ID mean 20080719233957
2008/july 19th/ at 11:39:57pm
34
What is the first thing an email touches
The received line is the first server the email touched
35
Where do undeliverable emails go
The return-path-field
36
What is MIME
Multipurpose Internet Mail Extensions
the internet standard for allowing emails to accept text other than ASCII, binary attachments, multi-part message bodies and non-ASCII base header information
37
_PART_ is the file starter for what
MIME extensions
38
Outlook stores files in what types
pst, mbd, or ost
39
Thunderbird or Mozilla stores files in what format
.MBOX file
40
what are MSF files
Mail summary files
41
What is RAM
Random access memory
contain info about the current running state of the system before you shut it down
snapshot of a live running system, whereas a hard drive examination is static.
RAM is much more transient
42
What is the downfall to collecting RAM
Capturing the data in RAM will lead to the loss of potential evidence. You are changing evidence when you collect RAM.
43
True or false: Data can be written on RAM at extremely fast speeds
True
44
What tactic is no longer recommended in digital investigations
"pull the plug tactic"
45
What are the two types of RAM
Dynamic ram (Dram) and Static ram (Sram)
46
What is the difference between Dram and Sram
SRAm is faster and more efficient than DRAM
DRAM is cheaper to produce
You will typically find SRAM being used as cache memory for the CPU
DRAM chips being used for memory chips for the computer system.
47
What size is data stored in RAM
4KB pages
48
What is privilege seperation
Privilege determines what a user, user account, and the process is allowed to access. It is a form of access control and when used by the operating system, it helps provide system stability by isolating users and the CPU kernel's actions
49
What is a system call
It is a bridge between the application and the operating system to allow the untrusted mode to become trusted for a specific instance
50
What is a thread
It is the basic unit of using the system's resources, such as CPU
51
What contents can you find on RAM
artifacts of what is or has occurred on the system
Configuration information, Typed commands, Passwords, Encryption keys, Unencrypted data, IP addresses, Internet history, Chat conversations, Emails, Malware
52
What is hiberfill.sys
Hibernation file
Hibernation is the process of powering down the computer while still maintaining the current state of the system.
53
What is pagefile.sys
Pagefile
Paging is a method of storing/retrieving data being used in the RAM chips with a virtual memory file stored on a traditional storage device
54
What is swapfile.sys
Swapfile
When the application is suspended, the system will write the application data in its entirety into the swap file.
55
what is memory.dmp
Crash Dump
Happens when the system crashes
When that occurs, it may create a dump of memory to store information about the state of the system at the time of the crash
56
3 types of crash dumps
complete memory dump
kernel memory dump
small dump files
57
what is a complete memory dump
The data contained within the physical memory.
58
what is a kernel memory dump
Will only contain pages of data that were in kernel mode
59
what are small dump files
Contains information about running processes/loaded drivers at the time of the crash
60
What is SWGDE
The Scientific Workgroup on Digital Evidence
61
5 considerations when collecting volatile data
The application used to collect the data in memory will overwrite some contents of the memory.
The larger the tool and associated files are, the more data it overwrites.
The system may load the USB device driver into memory.
The system may load the USB device driver into the registry.
The application that's used to collect the data in memory will show up in some Most Recently Used (MRUs).
62
3 things needed to capture RAM
A capturing device (such as a USB device)
Access to the system
Administrator privileges
63
What should your external device be formatted as when removing RAM
Your device should be formatted as an NTFS partition
64
What happens when a user first logs into a system
When the user first logs into the system, it will create a user profile
65
What will each user profile have
a registry hive
66
What does the registry hive contain
users preferences and configuration settings
67
4 types of user profiles
Local
roaming
mandatory
temporary
68
What is a Local user profile
This profile is created when the user logs on to a computer for the first time
69
What is a roaming user profile
This profile is an administrator-created, network-based profile.
70
What is a mandatory user profile
This profile is a profile created by the network administrators to lock users down to a specific set of settings when they use a host on the network.
71
What is a temporary user profile
This profile is created when an error occurs when the system is loading the user's profile
72
what are the 4 hive files
SAM
SECURITY
SOFTWARE
SYSTEM
73
What is the SAM hive file
The SAM hive is the Security Accounts Manager and contains login information about the users.
74
What is the SECURITY hive file
The SECURITY hive contains security information and, potentially, password information.
75
What is the SOFTWARE hive file
The SOFTWARE hive contains information about application information and the default Windows settings.
76
what is the SYSTEM hive file
The SYSTEM hive includes information on the hardware and system configuration
77
What is the NTUser.dat and what does it contain
An additional hive file which is stored in the root of the user profile
This contains information about the user behavior and their settings
78
What is GUI
Graphical user interface
79
what is a SID
Security identifier
80
what is an RID
Relative identifier
81
What are the three categories windows categorizes its events into
System: Information generated by the windows operating system
Application: Information generated by applications on the local machine
Security: Information related to login attempts
82
What are some things you will get from event IDs
Th euser account had a successful login
The user account failed to log in
The user account successfully logged off from the local host
The user account had a successful login using explicit credentials; for example the command was run as
The user account had a successful login with elevated permissions
The user successfully created a user account
83
What is a thumbcache
is a database of thumbnail images cereated when the user is using windows explorer in a thumbnail view
84
What is an MRU and where is it found
Most recently used
a list of recently used files that are stored in the users NTUSER.DAT hive
85
What is the goal of the recycle bin
effort to protect the user form their own actions
86
What is a jumplist
It allows the user to access frequently used/recently used files from the windows taskbar
87
What are the two types of jumplists
Automatic - system created. Records information about file usage
Custom - application-created. Records task-specific information about the application
88
What are shellbags
a set of registry keys that remember the size and location of the folders and libraries that the user has accessed via the GUI
89
What is prefetch
a feature microsoft introduced to enhance the user experience with the windows operating system by making faster response times to preloading data
stored in %WINDOWS%\PREFETCH
90
4 things codes tell you
Whether there is a wireless network association
Whether there is a connection to a wireless network
Whether there is a failed connection to a wireless network
When the system is disconnected from a wireless network
91
What is the shimcache and what information is stored in it
is used to track compatibility issues with executed programs
File Path
$Standard information attribute modify time
The update time of the shimcache
92
Issues with USB devices
can be used to exfiltrate data from one organization
they can be used to deliver malware to an organization to compromise its security protocols
93
Where do you find registry files
%SystemRoot%\System32\Config
94
When examining log files, which event ID identifies successful logon
4672
95
True or false: The mere presence of the artifact is a sign of a suspect's guilt or innocence
False
We cannot construe the mere presence of the artifact as a sign of a suspect's guilt or innocence
The artifact needs to be placed within the context of the user and system activity
96
3 issues with MAC times
These may not be accurate
A third party user can use a third-party tool to change the timestamps
Moving files from one volume to another alters timestamps
97
True or False: Hard-drive capacity is getting smaller
FALSE
Hard drive capacity is not getting smaller, in fact it is increasing at a phenomenal rate
98
Examples of forensic suites used for timeline analysis
X Ways
Belkasoft
Autopsy
Recon Lab
Paladin
99
What is plaso
Is a python backend and framework for the logtimeline forensic tool that pulls out timestamps from a system and creates a database of all events known as a super timeline
100
What does the image_export command do
Image export will export file content from a device, media image, or forensic image
101
What does the log2timeline command do
CLI tool that is designed to extract chronological-based events from files, directories, forensic images or devices
It will create a database file that can then be analyzed by a variety of tools
102
What does the pinfo command do
Command line that is used to display information about the plaso database file
103
What does the psort command do
CLI tool that allows you to filter, sort, and conduct analysis on the contents of the plaso database file
104
What does the psteal command do
This process also allows for filtering tagging and analysis.
105
What is an ELK stack
Elasticsearch is the search and analytical engine. Logstash is the data processor and ingest engine, while Kibana is the visualizer
106
What is TimeLineMakerPro
It is a commercial product specifically designed for creating timeline charts.
107
What is Aeon timeline
It is a commercial product specifically designed for creating visual timelines.
108
What is Timeline Explorer
Timeline Explorer is an open source platform created by Eric Zimmerman, who wanted a tool to read MAC time and plaso-generated CSV files without the need to use Microsoft Excel
109
What is allocated space
This is the space on the storage device that a file occupies. The filesystem recognizes the storage space as being used.
110
What is unallocated space
This is the space on the storage device that is not occupied by a file
111
what is slack space
When the data is stored in a cluster; if the file does not completely fill a cluster, the remaining space not used by the file is referred to as slack space
The space between the end of a logical file and the cluster boundary is called the file slack
112
what are bad blocks
This is the space on the disk that has been marked bad by the filesystem because of a defect. It can also be used by a user to hide data from a casual inspection
113
what is the Brian Carrier progression of media analysis
Disk, volume, filesystem, data unit, metadata
114
Why was unicode developed
was developed to overcome the limitations of ASCII
115
What is ROM
read-only memory
116
It is widespread practise to remove what to create a forensic image
It is a widespread practice to remove the hard drive from the system to create a forensic image
117
what does the C drive belong to
C drive belongs ot the logical partition of the hard drive
118
What makes up the interior hard drive
One or more platters stacked together with a spindle in the center to read and write data
Platters which are made of metal alloy or glass, are coated with a magnetic substance in which the heads magnetically encode information on the platters
The heads can write data on both sides of the platter
Actuators that control the heads
119
What are SSD's
are storage devices that contain no moving parts. Instead, they are made up of memory chips.
120
3 operations controlled by the firmware of SSD's
Wear leveling
Trim
Garbage collection
121
What is wear leveling
This spreads the writes across the different chips so that it uses the chips at the same rate.
122
What is trim in regards to SSD's
This will wipe the unallocated space of the device.
123
What is garbage collection in regard to SSD's
As the firmware scans the memory modules, it may identify pages within the data blocks that have been deleted. The firmware will move the allocated pages to a new block and will wipe the data block so that it can reuse the blocks. The firmware can only delete data in blocks.
124
What is drive geometry
defines the number of heads, the number of tracks, cylinders, and the sectors per track
125
What is the smallest storage unit on the device
A sector (B)
126
What is partitioning
occurs when we divide the physical device into logical segments called “volumes”
127
What was used to get around the partition limit
Extended partition
128
What is the partition limit
4
129
What is the FAT filesystem and what is the purpose
File Allocation Table
The purpose of the file allocation table is to track the clusters and to track which files will occupy the clusters
130
What is arguably the most important filesystem
NTFS filesystem
New technology filesystem
131
Evidence is a determination of the ____
trier of fact
132
3 things that make a forensically sound environment
Digital forensic examiner controls the working environment of the digital forensic examination
No actions will occur unless the digital forensic examiner intends the action to occur
When the action has been completed, the examiner will reasonably know what the expected outcome is
133
If an investigator cannot explaining the process of how a file system processes then _____
the testifying will be unsuccessful
134
4 ways to mitigate attacks on your process
Understand their functionality
Document your training
Take notes during the exam
Validate the tools
135
We must use what to prevent the alteration of the source device
We must use a write blocker.
136
2 types of write-blockers
hard ware writeblocker
software writeblocker
137
What does a hardware writeblocker do
a device that intercepts and prevents any modification to the source device.
138
What does a software write blocker do
where a change is made to the operating system to stop it from making writes to the device.
139
Whata re the two options when mounting a device
Read-only
Read/write
140
True or false: you should conduct your examination on the original evidence
FALSE you should always make a copy
141
What is a forensic copy
This is a straight bit-for-bit copy of the source to the destination.
We will recover deleted files, file slack, and partition slack.
142
what is a forensic image
We are creating a bit-for-bit copy of the source device, but we store that data in a forensic image format.
We will recover deleted files, file slack, and partition slack.
143
What is a logical forensic image
Due to this, we can make logical copies of the files and folders pertinent to the investigation. We will NOT be able to recover deleted files, file slack, and partition slack.
144
5 subsets of the forensic analysis process
Pre-investigation considerations
Understanding case information and legal issues
Understanding data acquisition
Understanding the analysis process
Reporting your findings
145
What are a few things that should be in your response kit
gloves, computer, notepad, paperwork, toolkit, camera
146
open source software
free for anyone to use
Use for educational, profit, or testing purposes
often CLI or GUI
147
Commercial software
paid for
more technical support
148
Daubert standards
Whether the theory or technique can be or has been tested
Whether it has been subjected to peer review and publication
The known or potential error rate
The existence and maintenance of standards
Its acceptance within the scientific community
149
Examples of open source forensic tools
CAINE
SIFT
Autopsy
Paladin
150
Examples of commerical software
X-Ways Forensics
EnCase
Forensic Toolkit (FTK)
Forensic Explorer (FEX)
Belkasoft Evidence Center
Axinom
151
Examples of organizations that provide training
International Association of Computer INvestigative Specialists(IACIS)
EnCase Certified Examiner (EnCE)
Accessdata Certified Examiner (ACE)
Computer Hacking Forensic INvestigator (CHFI)
Global Information Assurance Certification (GIAC)
152
Order of volatility (most to least)
Live system
Running
Network
Virtual
Physical
153
What does forensically sound manner mean
means leaving the smallest possible footprint during collection to minimize the amount of data being changed within collection
154
What is encryption
encryption is encoding information to protect the confidentiality of the information and allow only the person with the decryption key to access it.
155
4 things a chain of custody contains
Description of evidence
item number
quantity
description of item
156
What time must you set all of your tools in to account for time zone issues
Universal time (UTC) as a standard frame reference helps solve this problem.
157
What is a hash
A hash is a digital fingerprint for a file or piece of digital media.
158
What are the standard cryptographic algorithms used in digital forensics for hash analysis
MD5 and SHA-1
159
3 ways hash analysis can save time in investigations
You can use it to verify the evidence has not changed
It can be used to exclude files
It can be used to identify files of interest
160
What is a collision
occurs when two different variable inputs result in the same fixed-length output
161
What does file signature analysis do
Ensures the file extension matches the file type
162
What is digital forensics
It is a division of forensics involving the recovery and analysis of data that has been recovered from digital devices.
163
Most basic positions in forensics
First responder
Scene technician
Investigator
164
Two groups of investigators
sworn unsworn
165
What is a sworn officer
May take an oath to support the laws in their jurisdiction; they have the power to make arrests and carry firearms.
166
What is an unsworn officer
May take an oath but do not have powers to arrest. These positions are typically crime scene analyst or law enforcement support technicians
167
What will first responders identify
Potential victims
Witnesses
Potential suspects
How best to maintain control
168
What does an investigator do when they arrive
Take control of the scene
169
Before the government can seize information and evidence what must be obtained
A search warrant obtained
Or the consent of the owner
170
IN order to obtain a search warrant you must have _____ ______
probable cause
171
5 potential crimes in digital forensics
Stalking
p2p filesharing
Illicit images
Email based communications
newsgroups USEnet
172
What is binary
a file type-digital images, videos, audio software or any other file type
USEnet file
173
What is criminal conspiracy
A conspiracy occurs when two or more people agree to commit an illegal act
Just an agreement is not enough, there must be actions that carry out the plan
174
What is a policy
Statement from the organization addressing a specific issue
175
What is a procedure
Specific instructions regarding how to accomplish the goals of the policy
176
Golden rule in digital forensics
Treat every investigation as if you will go to court for it
177
What is corporate espionage
One organization spying on another organization to achieve commercial or financial gain
178
What is a hacker
A hacker is a malicious user gaining access to information systems that belong to another
179
What is a black hat
Someone who attacks a system with malicious intent
Goal is to violate and exploit the user information
180
what is a white hat
Positive hacker, no malicious intent
Intent is to identify vulnerabilities in the system so the owner can help to fix them
181
What is phishing
Attacker attempts to trick user into gaining access to confidential information such as username or passwords
182
2 facts about insider threats
Insider threats are more dangerous than outsider threats
They take up 1/3 of digital forensic investigations
183
What is required in the US to get subscriber information
A subpoena
