Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Exam 3 > Flashcards

Exam 3 Flashcards

1
Q

NTFS

A

New Technology File System
Allows for multiple filenames for same data.
Differentiates between upper and lower case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NTFS Structure

A

No system area, all data area.
Everything is a file.
Max number of files unlimited (only limited by drive size).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NTFS System Files

A

Boot record, root directory, and system area all files.
Normally start with $.
When formatted, system files created on drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Clusters in NTFS

A

Start counting at 0.

Cluster size usually 4096.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

$MFT

A

Master File Table.
Most important.
Takes the place of root directory and file allocation table.
Can take up to 12.5% of drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

$MFT Structure

A

Composed of records.
Includes $MFT itself.
First 16 records reserved for metadata files.
Every file and directory has at least one record here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

$MFTMIRR

A 
Backup Files.
First four records of $MFT.
    $MFT (0)
    $MFTMIRR (1)
    $Logfile (2)
    $Volume (3)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

$Logfile

A

Records operations affecting file structure.
Records file system changes.
Used for Recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

$Volume

A 
Information about the volume.
Volume name.
NTFS version.
State of volume.
Dirty Flag: requires checkdisk to run).
Checks for errors.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

$Logfile: Forensic Significance

A

Can contain information on creating, moving, or deleting files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

$AttrDef

A

Info about all attributes defined on a volume.
Not the same as FAT Directory attributes.
List of attributes can be extended or change by modifying this file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

.-Root Directory

A

Does not have $.
Listing of all files and folders.
\

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

$Bitmap

A

Like file allocation table.
Tracks cluster usage.
Allocation state of each cluster in volume.
Each bit indicates if a cluster is free or not.
1 if occupied, 0 if empty.
Does not point to cluster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

$Boot

A 
Volume Boot Record.
Located in sector 0 of volume.
Up to 16 sectors in length.
# of sectors per cluster.
Location of MFT.
Total sectors in volume.
Serial number.
Back-up of first sector of $Boot at end of volume.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Resident Files

A

Files under 1024 are contained completely within $MFT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Non-Resident Files

A

Files over 1024 will be stored somewhere other than $MFT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Metadata Files

A

File system files that are created during formatting process.
Not create by Windows.
Some can be used to recover deleted partitions ($Boot).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

$BadClus

A

File consisting of all bad clusters on volume.
If one cluster (sector?) entire cluster is marked bad.
1 for bad, 0 or good.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

$Secure

A

Contains all security descriptors used on volume and their hash.
File’s “security ID” is an index into $Secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

$UpCase

A

Translates upper and lower case letters.

Used to assist in sorting and searching file names.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Files

A 
Series of attributes.
Every file will have:
   Standard Information Attribute (SIA).
   Filename Attribute.
   Data Attribute.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Attributes

A

Anything that describe the file.

Name, Dates, Data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Folders

A

Every folder will have:
Standard Information Attribute (SIA).
Filename Attribute.
Index Root Attributes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

$MFT Records

A

Records are 1024 bytes in length.
Each record begins with 56 byte record header.
Offsets start at beginning of record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Standard Information Attribute

A 
SIA.
Present in every record.
96 bytes in length.
Contains dates and times associated with file.
0x10 00 00 00.
SIA always resident.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Update Sequence Array

A

If information goes over a sector (?) this keeps track of overflow data so it doesn’t get rewritten.
Has code so can find the rest elsewhere.
“fix-up” array.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Record Header

A

Offsets 0-4 signature (FILE is good to search for in records in unallocated space).
Update Sequence Array.
Sequence Count: Number of times $MFT has reused this record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Filename Attribute

A

FNA.
Every file and folder has one.
Dates not updated as frequently as SIA so unreliable.
0x30 00 00 00

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data Attribute

A

Every file has one.
0x80 00 00 00.
Can be Resident or Non-Resident.
Folders do not have a Data Attribute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Record Slack

A

Data from the End of Record Marker to end of 1024 record is Record Slack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data Attribute: Non-Resident

A

If data exceeds $MFT record (1024) it is placed in next available cluster.
A runlist of clusters will point to their location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Runlist

A

Has number of clusters and starting location.
If file is fragmented, there will be multiple run lists.
If multiple lists, location can be a negative value.
Location is a signed integer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

UTC

A

Grenich Mean Time.
Paris, France.
We are UTC-6.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Triage Rules

A 
#1: If the computer is off, leave it off!
#2: If the computer is on, it depends!
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Triage Documentation

A

Make, model, serial number.
What state is it in?
On? Off? Disconnected? Damaged?
Photograph.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Triage: Live Computer First Steps

A 
Wake computer (mouse, shift key).
Document and photograph all open windows.
Check task tray for open applications.
Check for encryption.
Do as little as possible.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Triage: Live Computer: Things to Check

A

Check task tray for open applications.

Check for encryption or encryption programs that are running.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Triage: Live Computer: Things to Get

A 
Make image.
Check online/cloud storage.
Try to get encryption passwords and codes.
Consider logical acquisition/RAM dump.
Capture RAM.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Triage: Online/Cloud Storage

A

When machine is off, access to these are gone.
Make sure warrant covers looking at this.
May need new/additional warrant.

40
Q

Triage: Encryption

A

Save encryption keys or get from IT if applicable/possible
OR Create forensic image of encrypted volume while accessible
OR Disable encryption if possible (this will change info, document everything!).

41
Q

Triage: Destructive Processes

A

Pull the plug!

Observe time from authoritative source.

42
Q

Triage: Client OS

A

Destructive processes: pull plug!
Observe time from authoritative source.
Document!
If client hosts network services, especially databases, shutdown normally.

43
Q

Triage: Server OS

A

Shutdown normally.
Observe time from authoritative source.
Document!

44
Q

Triage: Pull the Plug (Desktop)

A

Unplug power directly from the back of the computer.

NOT from the wall, because they can power runs through surge protectors and power filters.

45
Q

Triage: Pull the Plug (Laptop)

A 
Laptops have more than one power source.
Power Supply.
Battery.
Disconnet both to shut down.
It can be easier to do battery first.
Be sure to take power supply!
46
Q

Computer Boot Process in Lab

A

Need to boot computer without changing evidence.

47
Q

BIOS

A

Basic Input Output System.
Small code segment generally stored in ROM.
Includes information for a computer interact with different I/O devices.

48
Q

Boot

A

The startup process of a computer.

Allegedly from the word “bootstrap”.

49
Q

Bootable Media

A

Media that contains startup software.
Can be a CDROM, diskette, USB device, etc.
Newer computers are set to boot from CD/USB but older computer generally are not.

50
Q

CMOS

A

Complimentary Metal Oxide Semiconductor.
Contains system date/time and initial startup info.
Powered by a “button” battery on motherboard.

51
Q

KERNAL

A

The core that provides basic services to all other parts of the operating system.

52
Q

POST

A 
Power On Self Test.
CPU checks itself and POST program by comparing code against identical permanent records.
Checks system timer.
Pathways are available and functioning.
Verifies RTC.
Beeps tell you what's broken.
53
Q

RAM

A

Random Access Memory.

Volatile, lost when power is lost.

54
Q

ROM

A

Read Only Memory.

Does not rely on power for storage.

55
Q

BIOS: Booting

A

Typically try to disconnect hard drive first.
F2 usually boots into BIOS.
Hit boot sequence.
Change what you want to boot it to (Forensic tools, DVD, flashdrive, etc).
May do this right at scene if needed (missing child, etc).

56
Q

BIOS: Forensic Importance

A

Retrieve date and time that computer was seized.

Can show how many hard drives are connected.

57
Q

Forensic Examinations

A

These need to be done in every examination.
Document BIOS information.
Once recorded, make image.

58
Q

Extensible Firmware Interface

A

Much like BIOS except:
Has built-in boot manager.
Helps if there are multiple OS’s.
Specification that defines a software interface between an OS and platform firmware.

59
Q

BIOS Access

A

BIOS type.
System information (serial number, memory installed, model).
Date/time.
Boot sequence.

60
Q

RTC

A

Real Time Clock.

61
Q

Formats for Storing Digital Evidence.

A

Raw format.
Proprietary formats.
Advanced Forensics Format (AFF).

62
Q

Raw Format

A

Makes it possible to write bit-stream data to files.

63
Q

Raw Format: Advantages

A

Fast data transfers.
Can ignore minor data read errors on source drive.
Most computer forensics tools can read raw format.

64
Q

Raw Format: Disadvantages

A

Requires as much storage as original disk or data.

Tools might collect marginal (bad) sectors.

65
Q

Proprietary Formats

A

RAW, .dd, .001, .e01.
Option to compress or not compress image files.
Can split image into smaller segmented files.
Can integrate metadata into image file.

66
Q

Proprietary Formats: Disadvantages

A

Inability to share an image between different tools.

File size limitation on each segmented volume.

67
Q

AFF

A

Advanced Forensics Format.
Don’t see very often.
Provide compressed or uncompressed image files.
No size restriction for disk-to-image files.
Provide space in the image file or segmented files for metadata.
Open source for multiple platforms and OS’s.

68
Q

Types of Acquisitions

A

Static acquisitions.

Live acquisitions.

69
Q

Data Acquisition Methods

A

Bit-stream disk-to-image file.
Bit-stream disk-to-disk.
Logical disk-to-disk or disk-to-disk data.
Sparse data copy of a file or folder.

70
Q

Bit-stream Bit-to-image File

A

Most common method.
Can make more than one copy.
Copies are bit-for-bit replications of original drive.
ProDiscover, Encase, FTK.

71
Q

Bit-stream Disk-to-disk

A

When disk-to-image copy is not possible.
Consider disk’s geometry configuration.
Encase, SafeBack, SnapCopy.

72
Q

Logical Acquisition or Sparse Acquistion

A

When your time is limited.
Captures only specific files of interest to case.
Sparse also collects fragments of unallocated (deleted) data.
For large disks.
PST or OST mail files, RAID servers.

73
Q

Forensic Duplicate

A

Bit-for-bit copy of original media.

Copies all info and sectors on drive (deleted, slack, unallocated, etc.)

74
Q

File Copy

A

Only copies data files.

Does not include deleted or hidden files, file slack space, or unallocated or bad clusters.

75
Q

Physical Copy

A

Gets everything.

Want to do this unless not possible.

76
Q

Logical Copy

A

Only gets data area.

77
Q

Duplicate Imaging

A

Because computer evidence can be easily altered, destroyed, or hidden.
All data areas will be imaged.

78
Q

Duplicate Imaging: Advantages

A

Preservation of original evidence.
Prevention of inadvertently altering the original evidence during examination.
Can recreate perfect duplicate from duplicate and does not degrade.

79
Q

Sterilized Media

A

Start with this.
The media is wiped clean using software to write all zeroes to the media.
Ensures there is no residual data from previous investigations.

80
Q

Sterile Media

A

Media on which every byte has been overwritten by a known hex value or random hex value.
Also known as “wiping” or “sterilizing”.

81
Q

Forensic Sterilization

A

Forensic wiping.
0x00 is written over everything.
Allows for verification with checksum64 equals to 0.

82
Q

Non-Forensic Sterilization

A

Non 0x00 known characer or random character wipes.

83
Q

Wiping

A

Wiping resets to all 0’s.

84
Q

Deleting

A

Normal logical file removal operations:
Simple file deletion leaves data intact.
HDD format can leave data intact.
Removing a partition can leave data intact.

85
Q

When to Use Sterile Media

A

Whenever restoring suspect data to a drive.
Whenever someone brings you media (new or used) to place data or files onto.
Make them aware you will wipe it prior to placing the requested data on it.

86
Q

Validation of Sterile Media

A

Use PALADIN.
Does not matter if the media is recognizable by the OS.
If software requires that the OS recognize the media a successful wipe can never be validated.

87
Q

Validation

A

Not knowing = Not doing = DISASTER!

If you don’t know how to test and validate, should you really be a qualified forensic computer examiner?

88
Q

Write Blockers

A

Software or hardware process that will “block” all writes to the original media.

89
Q

Windows Based Imaging Tool

A

When using, media must be write protected.
Two methods:
Hardware.
Software.

90
Q

Hardware Write Blocker

A

Media is physically attached to write blocker before being attached to motherboard.

91
Q

Software Write Blocker

A

Is inserted between the OS and the disk/device drivers.

92
Q

Jumper Settings

A

Master to slave drive (IDE drives, SATAs do not have them).

93
Q

Hash

A

Check these to make sure they are duplicated properly (MD5 and SHA-1).
MD5 is 128 bit (16 byte) value.

94
Q

Orphan File

A

File where parent folder is overwritten.
EnCase calls them Lost Files/
$MFT record for the folder is overwritten by a new file entry.
Files in the original folder are now orphans.
No method to determine what original folder name was exists.

95
Q

Exam Stage

A

Check CMOS and BIOS for date/time.

96
Q

Index Root

A

Found in folders.
Can only hold a few filenames.
When additional names are added the attribute becomes non-resident.
When that happens, two additional attributes are incorporated.
Index Allocation Attribute.
Bitmap Attribute.

Digital Forensics (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions