Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber-Security > Data Acquisition > Flashcards

Data Acquisition Flashcards

1
Q

If your time is limited, what type of acquisition data copy method should you consider?

A

Sparse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What command works similarly to the dd command but has many features designed for computer forensics acquisitions?

A

dcfldd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What type of acquisition is done if the computer has an encrypted drive and the password or passphrase is available?

A

Live

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What did Microsoft add to its newer operating systems that make performing static acquisitions more difficult?

A

Whole disk encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which RAID configuration offers the greatest access speed and the most robust data recovery capability?

A

RAID 15

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What option is used with the dcfldd command to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512?

A

hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In addition to RAID 0, what type of RAID configuration is available for Windows XP, 2000, and NT servers and workstations?

A

RAID 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What type of acquisition is used for most remote acquisitions?

A

Live

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What term refers to the Linux ISO images that can be burned to a CD or DVD?

A

Linux Live CDs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

By what percentage can lossless compression reduce image file size?

A

50 percent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A separate manual validation is recommended for all raw acquisitions at the time of analysis.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does Autopsy use to validate an image?

A

MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In Autopsy and many other forensics tools, raw format image files don’t contain metadata.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

There’s no simple method for getting an image of a RAID server’s disks

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your disk-to-image file.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

FTK Imager requires that you use a device such as a USB dongle for licensing.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Unlike RAID 0, RAID 3 stripes track across all disks that make up one volume.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What older Microsoft disk compression tool eliminates only slack disk space between files?

A

DriveSpace

20
Q

What command displays pages from the online help manual for information on Linux commands and their options?

A

man

21
Q

Similar to Linux, Windows also has built-in hashing algorithm tools for digital forensics.

A

False

22
Q

Some acquisition tools don’t copy data in the host protected area (HPA) of a disk drive.

A

True

23
Q

Which type of format acquisition leaves the investigator unable to share an image between different vendors’ computer forensics analysis tools?

A

Proprietary

24
Q

In addition to md5sum, which hashing algorithm utility is included with current distributions of Linux?

A

sha1sum

25
Q

Acquisitions of RAID drives can be challenging and frustrating for digital forensics examiners because of how RAID systems are designed, configured, and sized.

A

True

26
Q

What’s the most critical aspect of digital evidence?

A

Validation

27
Q

Name the three formats for digital forensics data acquisitions

A

Raw, Proprietary formats, and AFF

28
Q

Name the three formats for digital forensics data acquisitions

A

Raw, Proprietary formats, and AFF

29
Q

With remote acquisitions, what problems should you be aware of?

A

Antivirus, antispyware, and firewall programs

30
Q

Why is it a good practice to make two images of a suspect drive in a critical investigation?

A

To ensure at least one good copy of the forensically collected data in case of any failures

31
Q

What’s the maximum file size when writing data to a FAT32 drive?

A

2 GB

32
Q

In Linux, the fdisk -l command lists the suspect drive as /dev/hda1. So, is the following dcfldd command correct? ddfldd if+image_file.img of=/dev/hda1

A

False

33
Q

Of all the proprietary formats, which one is the unofficial standard?

A

Expert Witness

34
Q

What are two concerns when acquiring data from a RAID server?

A

Amount of data storage needed and type of RAID

35
Q

With newer Linux kernel distributions, USB devices are automatically mounted, which can alter data on it.

A

True

36
Q

Which forensics tools can connect to a suspect’s remote computer and run surreptitiously?

A

EnCase Enterprise and ProDiscover Incident Response

37
Q

A hashing algorithm is a program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk

A

True

38
Q

A logical acquisition collects only specific files of interest to the case

A

True

39
Q

What does a sparse acquisition collect for an investigation?

A

Fragments of unallocated data in addition to the logical allocated data

40
Q

Name two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive

A

EnCase and X-ways Forensics

41
Q

FTK Imager can acquire data in a drive’s host protected area

A

False

42
Q

Commonly, proprietary format acquisition files can compress the acquisition data and segment acquisition output files into smaller volumes

A

True

43
Q

The main goal of a static acquisition is the preservation of digital evidence.

A

True

44
Q

Slower data transfer speeds and dealing with minor data errors are two disadvantages of the raw format

A

False

45
Q

In the Linux dcfldd command, which three options are used for validating data?

A

hash, hashlog, and vf

Cyber-Security (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions