Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Forensics Cedarville > Data Carving > Flashcards

Data Carving Flashcards

1
Q

What is Data Carving?

A

Unallocated system space has files extracted from it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Data rebuilding

A

Fixing files that are damaged or partially deleted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the MFT?

A

Master File Table?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What uses the MFT?

A

NTFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the overall structure of an MFT entry called?

A

A file record segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What things does a file record segment have in it?

A
  • Header
  • Attribute Record Header
  • Attribute type/name/value
  • Attribute record header…
  • 0xffffff
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How big is each MFT entry?

A

0x400

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SequenceNumber

A

Incremented each time the file record segment is freed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

FILE_RECORD_SEGMENT_IN_USE

A

Says if the file is deleted or not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

BaseFileRecordSegment

A

File reference to the base file record segment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How far in is the SequenceNumber?

A

16 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How far in is the FILE_RECORD_SEGEMNT_IN_USE?

A

22 bytes in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How far in is the BaseFileRecordSegment?

A

32 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

States for the FRSIU

A

01000 -> Existing file
00000 -> Deleted file
03000 -> existing folder
02000 -> deleted folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

States for the BaseFileRecordSegment

A

0 if the record is the “base” (first record for the file)
Otherwise it points to the base.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MFT Attributes

A

Each unit of information associated with a file.

17
Q

Where are attributes written that are too large for the current segment?

A

In an “extent”

18
Q

What is an ADS?

A

Alternate data stream.

19
Q

What is an alternate data stream?

A

A user defined attribute.

20
Q

What ADS’ is interesting to us?

A

The ZoneID
HostUrl
ReferrerUrl

21
Q

Why is the ZoneID interesting?

A

ZoneID 3 is the internet, meaning that the file was explicitly downloaded from the internet.

22
Q

Why is the HostUrl interesting

A

The URL of the file

23
Q

Why is the ReferrerUrl interesting?

A

URL that served the file

24
Q

Data recovery vs data carving

A

Recovery - the file is still in its fullness there
Carving - Raw medium without File system info

25
Q

PhotoRec

A

Automatically carves photos out of different spaces.

26
Q

Arsenal image mounter

A

An image mounter that lets you mount shadow copies.

27
Q

HxD

A

A raw hex editor.

28
Q

What is the jpg file header?

A

FFD8FF

29
Q

What is the jpg file footer?

A

FFD9

30
Q

What does an SSD do differently than an HDD?

A

SSDs have garbage collection which allows them to speed up performance by “caching” deletes.

31
Q

What is the TRIM command?

A

The OS telling a NAND drive that it does not need the data anymore.

32
Q

Why is the TRIM command important?

A

It allows garbage collection to happen more efficiently.

Cyber Forensics Cedarville (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions