Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Year 2 - University > Digital Forensics > Flashcards

Digital Forensics Flashcards

1
Q

What is the job of the lens?

A

To focus light/image onto centre

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the job of the filter?

A

Reduce the sensitivity to infrared light

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the job of the sensor?

A

Turns light into a recordable image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the DSP unit do?

A

Performs some basic image processing before the image is saved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the focal point?

A

A point on the optic axis where parallel light rays converge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the optic axis?

A

A line which runs perpendicular to the lens and directly through the middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does CMOS stand for? And what is its use?

A

Complementary metal oxide semiconductor
It helps the light sensitive sensor chip to record all of the data in a very short space of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does DSLR stand for?

A

Digital single lens reflex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are pixels?

A

Individual light sensitive cells which measure the amount of light that fall on them. They cover the cameras sensor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How are coloured images produced?

A

The light seen by the camera is split in to the three primary colours which can than be used to create an accurate image through the use of a Bayer filter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a Bayer filter?

A

A grid of coloured filters that sit over the sensor with red, green, and blue elements over individual pixels which will only allow their respective light colours through. It looks at pixels surrounding others to formulate an informed guess of what the true colour of that pixel is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the job of the colour filter array?

A

It allows the digital camera to ‘see’ colours as it is colourblind without this and can only determine light intensity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the two common configurations of the colour filter array? Can you describe them?

A

The Bayer pattern - checkered
The Stripe pattern - stripes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are photo sites?

A

Each square on the sensor element is a single photo site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why are there two times more green elements on the colour filter array compared to red and blue?

A

Due to the human eye being more sensitive to green light

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two main types of sensors in the camera?

A

CCD (charge coupled device) and CMOS (complementary metal oxide semiconductor)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define photodiodes

A

Semiconductor devices that generate an electrical charge in proportion to the number of photons which reach them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where are photodiodes typically found?

A

They are tightly packed on a silicone wafer in CCDs and CMOSs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the advantages of CCD sensors?

A
  • Proven record of technologies and commercialization
  • Low noise, high S/N because the surface is almost entirely photosensitive (compared to 1/4 in CMOS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the disadvantages of CCD sensors?

A
  • High power consumption, slower speed
  • on-chip peripheral circuits difficult to manufacture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the advantages of CMOS sensors?

A
  • Manufacture can be simpler and less expensive
  • Use less power than CCD
  • Physical size of detector is smaller
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the disadvantages of CMOS sensors?

A
  • Relatively high noise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where are CMOS sensors and CCD sensors typically used?

A

CMOS - modern consumer cameras (phones)
CCD - scientific applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the job of the DSP (digital signal processors) molecule?

A

To read out the voltages from the image sensor which are then fed into an onboard image processing module which contains proprietary algorithms for improving the perceived quality, demosaicing, and compression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define spacial sampling

A

The average light intensity per pixel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How many values per pixel to monochrome images have?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Why does the image appear blurry when the light intensity pattern is continuous?

A

Each pixel only record the average light intensity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define resolution

A

The dimensions by which you can measure how many pixels are on a screen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Why are sharper images shown on a phone compared to a laptop?

A

They both have the same number of pixels, but they are in a denser space on the phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a byte?

A

8 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How do we make an image darker?

A

By subtracting a fixed constant from each of the RGB values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define point processing

A

The process of adjusting a pixels value according to a transformation function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is an image histogram?

A

A graph which records the number of pixels in an image, and the light intensity of each of these pixels, and displays this as a bar chart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Why is a 4-bit image sometimes used instead of an 8-bit image?

A

It makes the image histogram clearer due to there being less values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the function of a look-up table (LUT)?

A

It implements a functional mapping of pixel intensity values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the seven methods for detecting photo forgery?

A
  • Reverse image search
  • EXIF data check
  • Specular reflection
  • Photogrammetry
  • Inconsistencies in shadows/reflections
  • Grey level resampling
  • JPEG signatures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is image processing?

A

The technique of applying a relevant mathematical operation on a digitised image to generate an enhanced image or extract some useful features such as edge, shape, and colour

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the six purposes of spatial filtering?

A
  • Image smoothing
  • Noise removal
  • Image sharpening
  • Edge detection
  • Inpainting
  • Pre-processing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How does image enhancement work?

A

It alters each pixel by the same amount in order to change the appearance of the image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Give three applications of image processing

A

Medical imaging
Self-driving cars
Satellite imaging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which edges does a vertical difference mask highlight?

A

The horizontal edges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which edges does a horizontal difference mask highlight?

A

The vertical edges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define median filter

A

The output pixel value is determined as the neighbourhood median

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Define correlated noise

A

There is some sort of structure or pattern in the noise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Define uncorrelated noise

A

No structure or pattern in the noise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Why does correlated noise appear?

A

Electrical interference, source/sensor interference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What effect does shutter speed have on noise?

A

Slower shutter speed can result in higher noise levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is Gaussian noise?

A

Noise where the majority of the pixels have the same value of 127. There is a normal distribution around this number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is uniform noise?

A

Where the probability of getting any light intensity for a pixel is the same, meaning the distribution is flat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is salt and pepper noise?

A

The pixels have either a value of 0 or 255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Why might salt and pepper noise appear?

A

Due to errors in transmission, dead pixels in a display, or photodiode leakage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the advantages of removing salt and pepper noise with a median filter?

A
  • Returns the median value of the pixels in the neighbourhood
  • Is non-linear
  • Is similar to a uniform blurring filter which returns the mean value of the pixels in a neighbourhood of a pixel
  • Unlike a mean value filter, the median tends to preserve steep edges
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Why does shot noise occur?

A

Due to the random fluctuations in photon energy captured by the image sensor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is readout noise?

A

Electrical charge built up within the camera from the different onboard processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are the two main types of pattern noise?

A

Photo response non-uniformity (PRNU) and dark signal non-uniformity (DSNU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is PRNU?

A

The variation in pixel sensitivity cause by manufacturing defects and the natural non-uniformity of the silicon used in the image sensor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is DSNU?

A

fixed pattern noise due to ‘dark currents’ that occur in the sensor even when no light is incident upon it

56
Q

How do you obtain the fingerprint for a specific device?

A
  1. Take at least 50 natural scene images using the suspected source camera
  2. Individually filter each image using a wavelet denoising filter
  3. Average together the filtered images to produce a unique fingerprint for the camera
57
Q

Why is the denoised image only an estimate?

A

Impossible to remove all noise

58
Q

Define latent fingerprint in terms of digital forensics

A

Pattern noise extracted from an evidential image

59
Q

Define exemplar fingerprint in terms of digital forensics

A

Average pattern noise extracted from a sample of images known to have originated from a specific imaging device

60
Q

Define steganograohy

A

The art/science of communicating by hiding secret messages in innocuous ‘cover’ objects

61
Q

Define acrostic

A

A text, usually a poem, in which particular letters, such as the first of each line, spell a word or phrase

62
Q

Define cover object

A

A message that can be transmitted without suspicion, such as an image file, digital sound, or written text

63
Q

Define stego-object

A

A cover object containing an embedded secret object

64
Q

Why should the same cover never be used more than once?

A

As two versions of one cover could easily be detected and possibly decoded

65
Q

Define stego-key

A

Used to encrypt the secret message

66
Q

Define pure steganography

A

Does not require the exchange of prior information such as a stego-key

67
Q

Define secret key steganography

A

A secret stego-key is exchanged prior to communicating using a stego-object

68
Q

Define binary image

A

Images whose pixels only have two possible intensity values

69
Q

What is the random interval method in steganography?

A

Where elements of the cover are chosen at random for hiding data. The ‘seed’ for the random places, typically a random number generator, must be available to both parties in the communication

70
Q

Define visual attack

A

A means of detecting embedded information, such as by visual inspection of the least significant bits only of a digital image

71
Q

Define statistical attack

A

Referring to non-visual methods for determining embedding

72
Q

Define image histogram

A

The frequency distribution of grey-levels within a digital image

73
Q

What does embedding in the least significant bits to do the image histogram?

A

Tends to average out pairs of values in the image histogram

74
Q

What statistical technique is used to determine the probability of embedding?

A

Chi-squared

75
Q

What do the observed values refer to in the Chi-squared equation?

A

The observed values are every other column in the image histogram

76
Q

What does a low chi-squared value imply?

A

That embedding has taken place

77
Q

What is the purpose of an image compression algorithm?

A

In order to reduce the storage requirements, sometimes at the expense of the image quality

78
Q

Define non-lossy (loseless) compression

A

Original image can be recovered exactly from compressed image file, such as portable network graphics (.png)

79
Q

Define lossy compression

A

Information lost when a file is compressed. Therefore, only an approximation to the original image is possible, such as joint experts photographic group JPEG (.jpg)

80
Q

Define coding redundancy

A

Caused by sub-optimal code words for encoding, a symbol typically represents a grey-level

81
Q

Define inter-pixel redundancy

A

Due to grey-level correlations between neighbouring pixels

82
Q

Define psycho-visual redundancy

A

Information contained within an image that is superfluous to the interpretation or aesthetics of an image

83
Q

In psycho-visual redundancy, what does clarity depend on?

A
  1. Spacial frequency
  2. Amplitude
84
Q

A measure of the compactness of a compressed image file is the compression raito Cr, but how is it defined?

A

b1/b2, where b1 is the number of bits in the original image and b2 is the number of bits in the encoded image

85
Q

Define symbol

A

A general term that can refer to pixel values or transformation coefficient values

86
Q

What is the first component of the image coder?

A

An image transformation (aka mapper)

87
Q

What does an image transformation do?

A

Converts the input image into a format that is better suited to encoding

88
Q

How does an image transformation convert the image into a format better suited to encoding?

A

It transforms pixels into coefficients. The coefficients that have a negligible magnitude can be discarded and the remaining can be coarsely quantised, thereby reducing the number of bits required to encode them

89
Q

What does the quantizer do?

A

Reduces the number of bits needed to store the coefficients that result from an image compression

90
Q

What does symbol coding do?

A

Compresses the image by exploiting the fact that in natural images some grey levels occur more frequently than others

91
Q

What is the JPEG image compression ‘recipe’?

A
  1. Split into 8x8 blocks and treat each separately
  2. Apply Discrete Cosine Transformation (DCT) to each image block
  3. Quantise the DCT coefficients
  4. Apply Huffman coding scheme to quantised coefficients
92
Q

Describe the process of Huffman encoding

A
  1. Determine the image histogram of symbol values
  2. Order the symbols by increasing probability of occurrence
  3. Combine the two symbols with lowest probability
  4. The above two steps are repeated until only the most probable symbol of the original image and the combined symbol remains
  5. Assign the code word 1 to the most probable symbol in the image and 0 to the combined symbol
  6. Efficient code words can now be assigned to the remaining symbols by reversing steps 2-4 and appending a 1 or 0 to the code word
93
Q

Define cryptosystem

A

Disguises messages, allowing only selected people to see through the disguise

94
Q

Define cryptography

A

The science of designing, building, and using cryptosystems

95
Q

Define cryptanalysis

A

The science of breaking a cryptosystem

96
Q

Define cryptology

A

The study of cryptogrpahy and cryptanalysis

97
Q

Define plaintext

A

The thing we want to keep private

98
Q

What is a key used for?

A

To ‘access’ the algorithm. Without it the cyphertext would not make sense

99
Q

What are the two basic methods for disguising messages?

A

Transposition and Substitution

100
Q

Describe the process of transposition encryption

A
  1. Write the key horizontally as the heading for columns
  2. Assign numerical values to each letter based on the letters order of appearance in the alphabet
  3. Align plaintext message across each column
  4. Read down each column according to ordinal value
101
Q

Describe the process of substitution encryption

A
  1. Write the alphabet splitting it across two rows in the middle
  2. Substitute each letter in the plaintext message with the letter above or below it to come up with the cyphertext
102
Q

Define symmetric key cryptography

A

Same key used to encrypt and decrypt the message

103
Q

Define asymmetric cryptogrpahy

A

Key for encryption is not the same as the key for decryption

104
Q

Define a hash

A

A transformation of data (message) into a distilled form (message digest) that is unique to the data and not reversible

105
Q

What is a hash used for?

A

To verify the integrity of the data

106
Q

What is the procedure for digital signing?

A
  1. Arrange for the intended recipient to obtain a copy of your public key
  2. Compute message digest for data
  3. Encrypt digest using private key and append it to the original message before sending it to the intended recipient
  4. Recipient uses sender’s public key to check the message has come from the sender and hasn’t been altered
107
Q

Define platter - hard disk drive structure

A

on which the information is stored

108
Q

define head - hard disk drive structure

A

writes to the platters

109
Q

what are tracks, sectors, and clusters?

A

tracks - a complete circuit
sectors - the smallest region
clusters - clusters of sectors

110
Q

how many sectors are typically in a cluster?

A

4

111
Q

define non-contiguous/fragmented files

A

operating system saves a file in fragmented sections so parts are placed in different locations to maximise the space on the hard disk

112
Q

define defragmentation

A

optimising the space on the hard disk by organising the parts of the files and allocating them more effectively

113
Q

two sectors of a cluster are used and two are not. what happens to the two that are not used?

A

they are file slack - they contain whatever was there before, such as partially overwritten, deleted files

114
Q

what is the best way to permanently delete something?

A

to overwrite it completely

115
Q

what is the handling system?

A

the part of the operating system which controls where the files are on the hard disk

116
Q

how are files generally identified?

A

by their three character extensions, such as .doc, .ppt

117
Q

what are file signatures and why are they important?

A

they are a known and recognisable header. they are important as they are a definite indicator of content as they cannot be changed, but extensions can

118
Q

give some examples of digital crime

A

hacking, trojans, grooming, viruses, blackmail, trafficking

119
Q

what is a worm?

A

a type of virus which can self-replicate without the user intervening. this can lead to a denial of service account (DOS)

120
Q

define principle 1 (data preservation)

A

no action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may be relied on in court

121
Q

define principle 2 (competence)

A

in circumstances where a person finds it necessary to access original data held on a computer or storage media, that person must be competent to do so and be able to give evidence explaining the relevance and implications of their actions

122
Q

define principle 3 (audit trial)

A

an audit trial or other record of all processes applied to computer-based electronic evidence should be created and preserved. an independent third party should be able to examine those processes and achieve the same result

123
Q

define principe 4 (responsibility)

A

the person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to

124
Q

why should you always remove the end attached the computer and not the end attached to the socket?

A

to avoid any data being written to the hard drive is an uninterruptible power protection device is fitted

125
Q

what should be seized for reconstruction of the system?

A

main unit
monitor
keyboard and mouse
all leads
power supply units
hard disks
dongles - small connectors plugged into the back of the machine

126
Q

In the forensic process, what does acquisition entail?

A
  • Correct consents, legal documents, and procedures must be in place
  • Pictures, video, written descriptions of where everything was found
  • Don’t alter anything
127
Q

In the forensic process, what does identification entail?

A
  • Physical identification of digital equipment, bagged and tagged
  • Where, logically, did the evidence come from?
  • What kind of evidence is it?
128
Q

In the forensic process, what does evaluation entail?

A
  • How was the data produced?
  • Who produced it?
  • When was it produced?
  • Is the evidence relevant to the investigation?
  • Are there any signs of foul play?
129
Q

In the forensic process, what does presentation entail?

A
  • Interpretation of data recovered
  • Write/present for non-experts
  • Technically correct
  • Defence of findings in the witness box
130
Q

Computer misuse act (1990)

A

Section 1 - unauthorised access to computer material
Section 2 - unauthorised access with intent to commit or facilitate the commission of a further offence
Section 3 - unauthorised modification of computer material

131
Q

Protection of children act (POCA) (1978)

A

Section 1:
a. taking, making, or possessing…
b. distributing…
c. possessing with a view to distributing…
an indecent photograph of a child

132
Q

Criminal justice and public order act (1994)

A

amended S(1) of POCA to include pseudo-photographs

133
Q

sexual offences act (2003)

A

amended POCA further:
- increase age of child from 16 to 18
- added a defence where an indecent photograph of a child over the age of 16 was created by the child’s long term partner
- added a defence where it is necessary to create an indecent image of a child for criminal investigation

134
Q

what are the two things which must be proven to prove a crime has been committed?

A
  1. actus reus - from the latin guilty act:
    - pictures found
  2. mens rea - from the latin guilty mind
    - pictures saved
    - pictures renamed
    - searching for pictures
    - browsing multiple pages
    - access to pictures
135
Q

define facial composite system

A

tool for creating a likeness to a suspect’s face based on an eyewitness’ description

136
Q

what were the four steps of the initial Fisher and Geiselman Original Cognitive Interview?

A
  1. reinstate the context - surrounding environment and how you were feeling
  2. report everything
  3. recall the events in different orders
  4. change perspectives
137
Q

what are the steps of the enhanced cognitive interview?

A
  1. rapport building
  2. recreate the context of the event
  3. open ended narration
  4. questioning
  5. closure
138
Q

why was perspective change removed from the cognitive interview?

A

traumatic for the victim and could lead to false memories

139
Q

what is the acronym for the reliability of eyewitness evidence?

A

Amount of time under observation
Distance
Visibility
Obstruction
Known or seen before
Any reasons to remember
Time lapse
Error or material discrepancy
ADVOKATE

140
Q
A

Year 2 - University (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions