Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Exam 1 > Flashcards

Exam 1 Flashcards

1
Q

Bit

A

The smallest unit of measurement that a computer can interpret.
Also called a binary digit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Binary

A

Being binary implies only implies only two possible states: 0 or 1
+5v or -5v
Yes or No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ASCII

A

American Standard Codes for Information Interchange.
7 bits per character.
Allows for 128 character possibilities.
1968.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Extended ASCII

A 
8 bits (1 byte) per character.
Added another 128 for a total of 256 characters.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Byte

A

Collection of 8 bits representing a single character.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Digital Forensics

A

The science of locating, extracting, and analyzing digital evidence in legal matters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

FBI CART

A

FBI Computer Analysis and Response Team.
Circa 1984.
No personal computers yet, started with larger main-frame type computers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Fourth Amendment

A

Search warrants needed for digital devices.
Probable cause that crime has occurred and evidence is still there.
Can no longer search phone incident to arrest.
Warrants only apply to government, not corporate or private.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Sub-Disciplines

A 
Growing in number.
Computer Forensics.
Network Forensics.
Data Recovery.
Disaster Recovery.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Network Forensics

A

Enterprise network environment.

Vulnerability assessment and risk management group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IACIS

A

International Association of Computer Investigative Specialists.
Formed by police officers who wanted to formalize credentials in computing investigations.
Formed in early 1990’s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Understanding Case Law

A

Technology evolves at an exponential rate.
Case law used when statutes or regulations don’t exist.
Laws developed in the 70’s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Computer Investigation Types

A

Public investigations.

Private or corporate investigations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Public Investigations

A

Law enforcement.
Performed by commissioned (armed) officers.
Moving toward more civilian investigators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Private Investigations

A

No fourth amendment restrictions.
Mostly internal with corporations.
Often have tools for own needs.
Can still involve legal-type aspects.
Everything from harassment to falsifying data.
Can lead to criminal charges.
Handles evidence similar to law enforcement so that if it becomes criminal it can be handed over to police or court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Professional Conduct in Corporate Investigations

A

Maintain objectivity by forming and sustaining unbiased opinions of case.
Keep cases confidential.
Case may become criminal if murder is involved (rare).
Professional conduct to maintain credibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Digital Forensics Examiner

A

Must know more than one computing platform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Corporate Investigation Guidelines

A

Display warning banners to remind visitors and employees of policies.
Establish company policies.
Define and limit number of authorized requesters who can start investigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Silver-platter Doctrine

A

When private investigations hand evidence over to law enforcement because of indications of criminal activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Computer Forensics Lab

A

Conduct investigations.
Store evidence.
House equipment, hardware, and software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ASCLD

A 
American Society of Crime Laboratory Directors.
Gives guidelines for:
Managing a lab.
Acquiring an official certification.
Auditing lab functions and procedures.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Lab Manager Duties: Administrative

A

Enforce ethical standards among lab staff members.
Create and monitor lab policies for staff.
Promote group consensus in decision making.
Set reasonable production schedules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Lab Manager Duties: Lab

A

Plan updates for lab.
Maintain fiscal responsibility for lab needs.
Provide safe and secure workplace for staff and evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Lab Manager Duties: Processes

A

Set up processes for managing cases.
Establish and promote quality-assurance processes.
Estimate when to respect preliminary and final results.
Estimate how many cases an investigator can handle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Lab Staff Member Duties

A 
Hardware and software.
OS and file types.
Technical training.
Deductive reasoning.
Investigative skills.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Lab Budget Training

A

Break costs down into daily/quarterly/annual expenses.

Use past investigation expenses to extrapolate expected future costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Lab Expenses

A

Hardware.
Software.
Facility space.
Trained personnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Lab Budget Planning

A

Estimate number of cases lab expects to examine.
Identify types of computers you’re likely to examine.
Account for changes in technology.
Use statistics to determine which computer crimes are most likely to occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Acquiring Certification and Training

A

Update skills through appropriate training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

CEECS

A

Certified Electronic Evidence Collection Specialist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

CFCE

A

Certified Forensic Computer Examiner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

HTCN

A

High-Tech Crime Network.
Certified Computer Crime Investigator, basic and advanced level.
Certified Computer Forensic Technician, basic and advanced level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

EnCE

A

EnCase Certified Examiner Certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

ACE

A

AccessData Certified Examiner Certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

HTCIA

A

High Technology Crime Investigation Association.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

SANS

A

SysAdmin, Audit, Network, Security Institute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

NTI

A

NewTechnologies, Inc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

FLETC

A

Federal Law Enforcement Training Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

NW3C

A

National White Collar Crime Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Physical Requirements for a Computer Forensics Lab

A

Secure so that evidence is not lost, corrupted, or destroyed.
Safe and secure physical environment.
Keep inventory control of assets.
Know when to reorder supplies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Lab Security Needs: General

A

Secure to preserve integrity of evidence data.
People working together should have same access level.
Staff briefed about security policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Lab Security Needs: General Minimum Requirements

A

Small room with true floor-to-ceiling walls.
Door access with locking mechanism.
Secure containers.
Visitor’s log.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Conducting High-Risk Investigations

A

These demand more security than min. requirements.
TEMPEST facilities, very expensive.
Electromagnetic Radiation (EMR) proof.
Can use low-emanation workstations instead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Using Evidence Containers

A

slide 6.2-7.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Overseeing Facility Maintenance

A

slide 7.2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Physical Security Needs

A

slide 7.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Auditing a Computer Forensics Lab

A

slide 8.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Computer Forensic Lab Floorplans

A

slide 8.2-9.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Selecting a Basic Forensic Workstation

A

slide 9.2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Workstations for Police Labs

A

slide 9.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Workstations for Private/Corporate Labs

A

slide 10.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Stocking Hardware Peripherals

A

slide 10.2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Maintaining Operating Systems and Software Inventories

A

slide 10.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Using a Disaster Recovery Plan

A

slide 11.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Planning Equipment Upgrades

A

slide 11.2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Using Laptop Forensic Workstations

A

slide 11.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Lab Summary Points

A

slide 12.1-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Expanded Bits

A

Every time you add a bit, you expand the possibilities by a factor of 2.

59
Q

1 Byte Conversion Table

A

128 - 64 - 32 - 16 - 8 - 4 - 2 - 1

60
Q

Byte to Decimal Conversion

A

Add the corresponding bit values (128, 64…2,1).

61
Q

Hexadecimal

A 
Base-16 counting system.
1 byte (8 bits) per hex value (4F).
62
Q

Decimal

A

Base-10 counting system.

63
Q

Nibble

A

Half a byte (4 bits).

64
Q

Hexadecimal to Decimal

A

16^1, etc. Do we need to know this??

65
Q

Unicode

A 
2 bytes (16 bits) per character.
Allows for 2^16 character possibilities.
Can accommodate multiple languages.
~ 68,000 human languages.
Sometimes uses 4 bytes per character.
Currently used in Windows, Macintosh, Office
66
Q

Reading Multiple Bytes

A

Some values require multiple bytes for a given value.

Windows date and time requires 8 bytes.

67
Q

Big Endian

A

Left to right.
Most significant byte is read first.
Motorola systems, old Macintosh.

68
Q

Little Endian

A

Right to left.
Least significant byte is read first.
Intel-based systems.

69
Q

Byte Groups: Words

A

1 byte: BYTE.
2 bytes: WORD.
4 bytes: DWORD (double word).
8 bytes: QWORD (quad word).

70
Q

Byte Groups: Numbers

A

1 byte: BYTE.
2 bytes: SHORT.
3 bytes: INT.
4 bytes: LONG.

71
Q

Byte Groups: Integers

A

Numbers can be expressed as positive or negative (signed integers).
Numbers with only positive values (unsigned integers).
Pos/neg values determined by left-most bit.
0 indicates positive integer, 1 indicates a negative.

72
Q

Encryption

A

The process of obfuscating data through some encoding methodology or mathematical formula.
This can be a the bit, nibble, or byte level.

73
Q

Bit Shifting

A

The process of shifting bits in a byte left or right.

74
Q

Nibble Swapping

A

Switches two nibbles within a byte.

75
Q

Bit Xoring

A 
Using a key.
Adding bits together.
0 + 0 = 0.
1 + 1  = 0.
1 + 0 = 1.
76
Q

Hex Editors

A

HxD.
Winhex.
Diskedit.

77
Q

Offset

A

Number of bytes from a designated point.

Beginning of file, sector, drive, record, attribute.

78
Q

File Extensions

A

Use three letter extensions to help identify them.
(doc, exe, jpg, pdf,txt,etc.)
Changing extensions prevent files for opening.

79
Q

File Headers

A

In many file types, the first few bytes of data contain specific values that indicate file type.
If changed, file cannot be viewed properly.
Also known as Signatures or Magic Numbers.

80
Q

File Type Viewers

A

Instead of using native application to view files, it’s often easier to use a file viewer.
Quickview Plus, Keyview Pro, Diskjockey 2000.

81
Q

Graphic Viewers

A

slide 15.1

82
Q

Hash Value

A

Value is expressed in hexadecimal and is calculated based on the content of the item examined.
Digital fingerprint of a particular file at a particular time.
Any content changes changes value.

83
Q

Hashing Algorithms

A

MD5.
SHA-1.
CRC.

84
Q

MD5

A 
Hashing algorithm.
Commonly used in forensics.
Typically expressed as a hex number.
128 (16 bytes, 32-digit hex number) long.
1 to 2^128 chance in two being the same.
85
Q

SHA-1

A

Hashing algorithm.
Commonly used in forensics.
160 bits (20 bytes) long.
Weaknesses make it unfit for cryptographic use.

86
Q

Hashable Data

A

Text string (group of words).
Files, data region, sectors.
Volumes and physical drives.

87
Q

Authentication and Verification of Files

A

Use hash values to see if they are in fact the same file or not.

88
Q

Hashing

A

One way process.
Cannot create file from hash.
Get hash from input.

89
Q

Hash Values in Forensics

A 
Identification.
Verification.
Authentication/Validation.
Value matching for file exclusion.
Value matching for file flagging.
90
Q

Hash Input

A

Arbitrary block of data.
Any given data object (file, sector, cluster, volume, media device, application, text block, etc.)
Individual bytes, hex values, or also text.

91
Q

Hash Output

A

Regardless of the size of the input object, the result is a fixed-length hexadecimal value.
Hexadecimal digest is mapped to its input object.

92
Q

CRC

A 
Hashing algorithm.
Cyclic Redundancy Check.
Developed to ensure data integrity.
Used especially during transmission.
Used for sector checking: bad or good.
Make sure programs are not corrupted.
93
Q

Checksum vs. CRC

A

16,32,64-bit variations.
Commonly used to ensure data integrity.
Detection of unwanted change in programs or data strings.
Verification of sterilization.

94
Q

CRC in Forensics

A

Old and weak.

Not used anymore except as a wipe verification using Checksum64 (similar in concept to CRC).

95
Q

Forensic Hash Verification

A

Show data has not been altered.
Renaming file (without altering contents) does not change hash value of file.
Verify no changes made during imaging.
Verify zero-wipe (Checksum64).

96
Q

Forensic Hash Authentication/Validation

A

Validate data received from opposing expert was not corrupted.
Validate copied image file.
Under proper circumstances can authenticate that restored image to another HD is exact copy of original HD.

97
Q

Hash File Exclusion

A

Exclude authentic system files from exam.
Exclude known software files from exam.
Greatly reduces number of files being examined.
Increases speed of exam.
Also called “negative hashing” or “De-NISTing”.

98
Q

Hash File Flagging

A

Hash list of known files can be compiled and matched against files found on image.
Watermarking files

99
Q

Hash Set

A

List or database of common hash values.
Files you seek to eliminate from exam.
Files of interest to identify.
Investigators sometimes share hash values to link subjects to crimes in other jurisdictions.

100
Q

Hash “Collisions”

A

Chinese researcher “broke” MD5 hash by producing 2 files with same hash value.
Manipulated bit by bit until it matched.
May be questioned about this in court.
Enough to make community move to SHA-1.

101
Q

Hash Value Mismatches: Software

A

Same data, different results.
Some programs that create image files add data to files.
Bad memory.
Carving functions of different programs may differ (logical file size vs. physical size).

102
Q

Hash Value Mismatches: Hardware

A

Same data, different results.
Read errors on data media, bad sectors.
Different utilities may read bad sectors differently.
First hash done on device, second on volume level.

103
Q

SSD

A 
Solid State Drives (2007).
Contains no moveable parts.
Speeds up access to data.
Uses less battery power.
Built-in storage efficiency and intelligence.
104
Q

SSD Garbage Collection

A

Relocation of data on the drive so that space for deleted files can be erased for re-use.
Broken into “blocks”.

105
Q

SSD Garbage Collection: Blocks

A

Each block contains smaller “pages”.
Data written to pages but only an entire block can be deleted.
If block has 1 page unused, it will relocate it to be able to delete that block.

106
Q

SSD Wear-Leveling

A

SSD blocks have a life-cycle for write/erase.
3,000-10,000 cycles.
Controller moves data from a more used block to lesser used block.
Done to ensure uniform “wearing” of the drive.

107
Q

SSD Feature Problems

A

Garbage collection and wear-leveling.
Independent of the OS drive is used on.
Known to activate when SSD is in use, idle or a few minutes after power on.

108
Q

SSD Forensic Problems

A

Features resident on controller so connecting it to write-blocker does NOTHING.
Very possible to get hash mismatches even after properly blocking them.
Need to be aware of issues and be able to explain them.

109
Q

Hardware

A

The physical parts of a computer system.

110
Q

Software

A

Instructions for the computer.

111
Q

Electro Static Discharge

A

Human body can build up charge in the range of 25,00 volts.

Data stored as pos/neg .05 volts, as 1’s and 0’s on the drive.

112
Q

System Ports

A

SCSI: Small Computer System Interface.
NTSC video.
Firewire.

113
Q

Motherboard

A

Main printed circuit board.
Securely mounted inside case.
Embedded with some laptops.
Contains several buses, ports, and sockets.

114
Q

CPU

A

Central Processing Unit.
Located in socket on motherboard, usually covered by a heat sync device.
ZIF (Zero Insertion Force) pins.

115
Q

CMOS

A

Complimentary Metal Oxide Semiconductor.
Battery on motherboard.
Maintains system date, time, boot sequence, diagnostic information.
Most susceptible component to Electro Static Discharge.

116
Q

BIOS

A

Basic Input Output System.
POST (Power On Self Test).
Instructions held in ROM.
May be password protected.

117
Q

Memory

A

ROM.

RAM.

118
Q

ROM

A

Read-Only Memory.

Permanently stored instructions.

119
Q

RAM

A 
Random Access Memory.
Group of memory chips.
Dynamic RAM (DRAM).
120
Q

Bus

A

slide 13.2-3

121
Q

Expansion Board

A

slide 14.1-3

122
Q

Hard Disk Drives

A

HHD.
Store operating system (OS), programs, files.
Controllers are part of drive (IDE, SATA, etc).

123
Q

IDE

A

Integrated Drive Electronics.
Each IDE bus is a channel in which two devices can be installed on (Master and Slave).
Primary and Secondary.
40-pin ribbon cable.
Officially know as the ATA (AT Attachment specification).

124
Q

SATA

A

Serial Advances Technology Attachment.

Serial ATA cable.

125
Q

HHD Encoding Methods and Interfaces.

A

IDE.
EIDE.
SATA.
SSD.

126
Q

EIDE

A

Enhanced Integrated Drive Electronics.

127
Q

HDD Interfaces

A

Normally today’s motherboards have at least two IDE/EIDE buses.

128
Q

Platter

A

Drives usually have more than one.
Each is referenced by top and bottom sides or heads.
Each side is broken into concentric circles called tracks.
Usually numbered starting with 0.

129
Q

Tracks

A

The concentric circles on a platter.
Numbered starting with 0.
Broken into sectors.

130
Q

Cylinder

A

The group of identically number tracks across multiple platters.
Numbered starting with 0.

131
Q

Sectors

A

Section of a track.
Numbered starting with 1.
Each sector always 512 bytes of data in DOS/Windows system.
Lots of wasted space.

132
Q

Hard Drive Structure

A

Number of tracks or head may vary depending on size of drive.

133
Q

CHS

A

Cylinder Head Sector.
3D coordinate for data.
First identify Head, then cylinder, then sector (although not written that way!).
Can be used to calculate drive capacity.

134
Q

Calculating Drive Size

A

Cylinders * Heads * Sectors per Track * 512 bytes per sector.
Usually assume that number of sectors per track is constant.
Current drives usually have 63.

135
Q

Formatting

A

Current drives use zone recording.

136
Q

LBA

A

Logical Block Addressing.

Treats sectors linearly then translated CHS value to operating system.

137
Q

MBR

A

Master Boot Record.
First track is reserved for it, only uses 1 sector.
First 446 bytes of MBR contain Boot Code.
Remainder is made up of the Partition Table (64 bytes).
Gives info about itself (location, size, structure, etc).

138
Q

Boot Code

A

First 446 bytes of MBR.
Code varies depending on OS.
At offset 440 there is a 32-bit value called the Disk Signature.

139
Q

Partition Table

A

Allows for 4 16-byte entries.

Last two bytes of the sector are hex values 55 AA.

140
Q

MBR Partition Table Entries

A

slide 15.1

141
Q

Boot Indicator

A

Only one partition can be marked as bootable.
00 non -bootable.
80 bootable.

142
Q

MBR in Forensics

A

First track reserved for MBR, but it only uses one sector, so there are lots of space to hide things.

143
Q

Primary vs. Extended Partitions

A

Primary partitions can be bootable.

Extended partitions cannot.

144
Q

Extended Partitions

A

There can only be one extended partition.
Extended partitions can be split into multiple logical drives/volumes.
A partition table exists in the first sector of each logical volume.
No boot code will be present and at most only two entries will be used.

Digital Forensics (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions