Domain 7 Flashcards
taking a bit by bit image or binary image of physical memory, gathering details about running processes and gathering network connection data
live forensics
portions of a disk partition that are marked as actively containing data
allocated space
portions of a disk partition that do not contain active data
unallocated space
data is stored in specific sized chunks known as clusters which are sometimes referred to as sectors or blocks
slack space
hard disks routinely end up with sectors that cannot be read due to some physical defect
bad block/clusters/sectors
Legal counsel gaining access to pertinent electronic information during the pretrial discovery phase of civil legal proceedings
e-discovery
Incident response steps
detection ( identification)
response ( containment )
mitigation ( eradication )
reporting
recovery
remediation
lessons learned
incident response phase that includes steps before an incident occurs. ex: preparing an incident handling checklist
preparation
incident response phase, aka identification, is the phase in which events are analyzed in order to determine whether these events might comprise a security incident
detection
incident response phase, aka containment, is the point at which the incident response team begins interacting with affected systems and attempts to keep further damage from occuring as a result of the incident
response (containment)
A binary forensic backup is made of systems in what incident response phase?
response (containment)
incident response phase, aka eradication, that involves the process of understanding the cause of the incident so that the system can be reliably cleaned and ultimately restored to operational status later in the recovery phase
mitigation (eradication)
incident response phase ____ occurs throughout the process beginning with detection
reporting
incident response phase that involves cautiously restoring the system or systems to operational status
recovery phase
incident response phase that occurs during the mitigation phase and involves mitigating vulnerabilities in the system
remediation
the goal of this incident response phase is to provide a final report on the incident which will be delivered to management
lessons learned
A worm spreading on a trusted network; NIDS alerts
What kind of positive/negative?
true positive
