Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPEG495 > FINAL > Flashcards

FINAL Flashcards

1
Q

What are Hardware Forensic Tools

A

single-purpose components to computer systems and servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are software forensic tools used for

A

create copy of data from suspect’s disk drive to an image file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Types of Software forensic tools

A

Command-line applications, GUI applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the categories of validated tools

A

Acquisition, Validation & Verification, Extraction, Reconstruction, Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO Standard 27037

A

Digital evidence first responders should use validated tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Acquisition definition

A

Making a copy of the original drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Acquisition subfunctions

A

Physical data copy, logical data copy, data acquisition format, command-line acquisition, gui acquisition, remote & live & memory acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Acquisition methods

A

Physically copying entire drive, logically copying disk partition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Format for Disk Acquisition

A

vary from raw data to vendor-specific proprietary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Acquisition Common feature

A

Creating smaller segmented files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do larger organizations use for acquisition

A

Remote acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Validation Definition

A

Way to confirm that a tool is functioning as intended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Verification Definition

A

Proves that two sets of data are identical by calculating hash values or using another similar method, also separating good and suspicious data (filtering)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Validation: common file header value purpose

A

see whether a file extension is incorrect for the file type, identifiable by most forensic tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Extraction Definition

A

Recovery task in digital investigation, most challenging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Extraction Subfunctions

A

Data viewing, keyword searching, decompressing, carving, decrypting, bookmarking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What can be used to speed up analysis (extraction)

A

Keyword search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What can you do when things are password protected (2 options)

A

Brute force or dictionary attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Reconstruction definition

A

Re-create a suspect drive to show what happened during a crime or an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Reconstruction methods

A

Disk-to-disk copy, partition-to-partition copy, image-to-disk copy, image-to-partition copy, disk-to-image copy, rebuilding files from data runs and carving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How to recreate an image of a suspect drive

A

Copy an image to another location, such as a partition, physical disk, or a virtual machine, easiest: direct disk to image copy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Disk to image copy tools

A

Linux dd command, ProDiscover, Voom technologies shadow drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reporting purpose

A

to perform a forensics disk analysis and examination, you need to create a report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Report subfunctions

A

Bookmarks or tagging, log reports, timelines, report generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

First tools for analysis

A

MS-DOS, Norton DiskEdit, Command-line tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What has mostly replaced Unix

A

Linux

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SMART features

A

Multiple linux versions, several file systems, many plug-in utilities, hex viewer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Helix 3 features

A

One of easiest, can load on Windows, loads bootable Linux OS from cold boot, not necessarily valid in international court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Kali Linux features

A

Includes variety of tools and has an easy-to-use K Desktop Environment interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Autopsy and SleuthKit features

A

Sleuthkit is linux forensics tool, autopsy was the browser interface to access SleuthKit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Forcepoint Threat Protection features

A

Linux memory analysis tool, both onsite and remote memory acquisitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

GUI Forensic tools purpose

A

Simplify digital forensics investigations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Structure of GUI tools

A

Suites of tools with simplified training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Advantages of GUI tools

A

ease of use, multitasking, no need for learning old OS’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Disadvantages of GUI tools

A

Excessive resource requirements, inconsistent results, tool dependencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Budget Considerations

A

time of workstation, failures, consultant and vendor fees, anticipate equipment restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Categories of Forensic Tools

A

Stationary, portable, lightweight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Advantages of Forensic Workstations

A

Customized to needs, save money

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Disadvantages of Forensic Workstations

A

Hard to find support, can become expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Vendor Workstations

A

F.R.E.D, mounts from ForensicsPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Advantages of Vendor Workstations

A

Support, mix and match components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Write blocker definition

A

Prevents data writes to hard disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Software Blocker Feature

A

run in shell mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Hardware blocker features

A

ideal for GUI tools, bridge between suspect drive and workstation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Write blocker connecting technologies

A

Firewire, USb 2.0 & 3.0, Sata & Pata & scsi controllers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Recommendations for forensic lightweight workstation

A

full tower to allow expansion, memory and processor power as budget allows, different size hard drives, 400-watt or better power supply with backup battery, external fireWire and USB ports, assortment of drive adapter bridges, good video card, high-end video card and dual monitors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

CFTT

A

Computer forensics tool testing, manages research on forensics tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Lab must meet these criteria

A

Establish categories for tools, identify forensics category requirements, test assertions, identify test cases, establish a test method, report test results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

ISO 5725

A

Specifies results must be repeatable and reproducible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

National Software Reference Library Project

A

Collects all known hash values for commercial software applications and OS files, filtering known information, use RDS to locate and identify known bad files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Validation Protocols

A

Verify results, use at least two tools, understand how tools work, compare results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Disk editor features

A

reliable tools, access raw data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Digital Forensics Examination Protocol

A

Perform investigation with GUI tool, verify your results with disk editor, compare hash values obtained with both tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Digital Forensics tool upgrade protocol

A

Test, report problems with tools, use test hard disk for validation, check for any updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Types of Images

A

Bitmap images, vector graphics, metafile graphics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Bitmap Images

A

Collection of dots, grid of individual pixels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Vector Graphics

A

Based on mathematical instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Metafile Graphics

A

Combination of bitmap and vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Types of Graphic file programs

A

Graphics editors, image viewers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Raster Images

A

Pixels are stored in rows, better for printing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Image Quality is based on…

A

Screen resolution, software, number of color bits per pixel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Characteristics of Vector Graphics

A

Use lines instead of dots, store calculations for drawing lines and shapes, smaller than bitmap files, preserve quality when scaled up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Vector Graphic Softwares

A

CoreIDRAW, Adobe illustrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Metafile advantages and disadvantages

A

Share with both types, when enlarged bitmap part loses quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

PNG

A

Portable Network Graphic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

GIF

A

Graphic Interchange Form

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

JPEG

A

Joint Photographic Experts Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

TIFF

A

Tagged Image File Format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

BMP

A

Window Bitmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Standard Vector File Formats

A

Hewlett Packard Graphics Language (hpgl), Autocad (dxf)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

TGA

A

Targa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

RTL

A

Raster Transfer Language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

.psd and .ai

A

Adobe Photoshop and Illustrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Freehand

A

.fh11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

SVG

A

Scalable Vector Graphics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

PCX

A

Paintbrush

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Raw file format properties

A

‘digital negative’, typically found on many higher-end digital cameras, maintains best picture quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Raw file format disadvantage

A

Not all image viewers can display proprietary images

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Demosaicing

A

Process of converting raw picture data to another format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

EXIF

A

Exchangeable image file, used to store digital pictures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

How to view EXIF metadata

A

Exif reader, IrfanView, Magnet Forensics AXIOM, Autopsy metadata at beginning of file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What type of files compress their data

A

Graphics (GIF and JPEG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Types of data compression

A

Lossy and Lossless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Properties of Lossless compression

A

Reduces size without removing data, based on Huffman or Lempel-Ziv Welch coding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Properties of Lossy Conversion

A

Permanently discards bits of information using Vector Quantization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Vector Quantization

A

Determines what data to discard based on vectors in graphics file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Properties of OS Tools for Locating and Recovering Graphics Files

A

Time consuming, results are difficult to verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Properties of Forensic tools for locating and recovering graphics files

A

Use image headers to create a baseline analysis, reconstruct fragmented files by identifying data patterns and modified headers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Carving or Salvaging

A

Recovering ay type of file fragments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

How to reconstruct image header

A

compare hex values of known graphics file formats with the pattern of found header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Steps to Reconstruct File Fragments

A

Locate and export all clusters of file, determine starting and ending cluster number for each fragmented group of sectors, copy each fragmented group of sectors in their correct sequence to a recovery file, rebuild file header, add .txt extension on all copied sectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Analyzing Graphics File Headers

A

Necessary on unrecognized tools, use hex editor such as winhex to record hex values in header and use them to define file type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Properties of tools for viewing images

A

no one tool works for all types, most GUI forensics tools include image viewers that display common image formats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Steganography

A

hides information inside image files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Steganography major forms

A

insertion and substitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Insertion Steganography

A

Hidden data is not displayed when viewing host file in its associated program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Substitution Steganography

A

Replaces bits of the host file with other bits of data, usually change last two least significant bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Clues for Steganography

A

Duplicate files with different hashes, steganography programs on suspect’s drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Steganalysis Tools Purpose

A

detect, decode, and record hidden data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Scope Creep

A

When investigation expands beyond original description, due to unexpected evidence, increases time and resources needed to extract, analyze, and present evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What to include in investigation plan

A

goal/scope of investigation, materials needed, tasks to perform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What should you investigation plan rely on

A

Type of case, i.e. corporate, criminal, civil

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Steps for digital forensic investigations

A
  1. Use wiped media reformatted and inspected for viruses for target drive
  2. Inventory the hardware on the suspect’s computer, note condition of seized computer
  3. For static acquisitions, remove original drive
  4. Record how you acquired
  5. Process contents
  6. List folders and files
  7. Examine contents
  8. Recover file contents for password-protected
  9. Identify function of executable files that don’t match hash values
  10. maintain control of all evidence and findings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Autopsy File Systems Microsoft

A

FAT, NTFS, ExFAT, UFS1, and UFS2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Autopsy File Systems ISO

A

9660, YAFFS2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Autopsy File Systems MAC

A

HFS+, HFSX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Autopsy File Systems Linux

A

Ext2fs, ext3fs, Ext4fs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Autopsy file formats

A

Raw, Expert Witness, and vm image files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Validating Forensic Data Process

A

Ensure integrity of data, hash image files, advanced hex editors to ensure integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What do Hex editors offer that forensics tools do not

A

hashing specific files or sectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Advantage of recording hash values

A

Determine whether data has changed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Block-wise hashing

A

process that builds a data set of hashes of sectors from the original file, examines sectors on suspect drive to find sector match, confirmation of file stored on suspect drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

AccessData’s own hashing database

A

Known File Filter, filters known program files from view and contains hash values of known illegal files, compares known file hash values with files on your evidence drive to see whether they contain suspicious data, others import NSRL db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Validate with Expert witness or SMART format

A

additional options for hashing all the data are available, validation report lists MD5 and SHA-1 hash values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Data-Hiding

A

Changing or manipulating a file to conceal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Techniques for Data-Hiding

A

Hide entire partition, change file extensions, set file attributes to hidden, bit-shifting, encryption, password protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

what command hides by unassigning the partition

A

diskpart remove letter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

How to detect if partition is hidden

A

Account for all the disk space when examining an evidence drive, analyze space you can’t account for

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Can forensics tools detect and view hidden partitions

A

Most can

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

FAT file systems data-hiding technique

A

placing data in free or slack space on partition clusters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

How does the FAT system trick other OS’s into thinking good clusters are unusable

A

Mark them as bad clusters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What is bit-shifting

A

Low level encryption program that changes the order of binary data, changes data from readable code to data that looks like a binary executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What softwares provide ability to bit-shift

A

winHex and Hex workshop

121
Q

Digital Watermarking Definition

A

Way to protect file ownership, usually not visible when used for steganography

122
Q

Way to make cracking message really difficult (steganalysis)

A

Encrypt plaintext file with PGP and insert encrypted text into steganography file

123
Q

Steganalysis Methods

A

stego-only, known cover, known message, chosen stego, chosen message

124
Q

What is key escrow

A

Technology designed to recover encrypted data if users forget passwords or use key is corrupted

125
Q

Key escrow key sizes

A

128 bits to 4096 bits

126
Q

Password cracking tools

A

Last bit, AccessData PRTK, ophcrack, John the Ripper, Passware

127
Q

Rainbow Table

A

File containing the hash values for every possible password that can be generated from a computer’s keyboard

128
Q

Salting Passwords

A

Alters hash values and makes cracking passwords more difficult

129
Q

Ways to recover passwords

A

Dictionary attacks, brute-force attacks, rainbow tables

130
Q

Software that runs virtual machines

A

hypervisor

131
Q

Types of hypervisor

A

Type 1: Loads on physical hardware and doesn’t require separate OS, Type 2: rests on top of existing OS

132
Q

Which type of hypervisor is typically found on suspect machine

A

Type 2

133
Q

What type of hypervisor is typically on servers or workstations with a lot of RAM and storage

A

Type 1

134
Q

Virtualization Technology

A

Intel’s CPU design for security and performance enhancements that enable the BIOS to support virtualization

135
Q

Virtualization Machine Extensions

A

Instruction sets created for intel processors to handle virtualization

136
Q

Popular type 2 hypervisors

A

Parallels Desktop, Kernel-Based Virtual Machine, Microsoft Hyper-V, VMware Workstation and Player, VirtualBox

137
Q

How to detect if VM is on a host computer

A

Look in Users or Documents folder, check hosts registry for clues that VMs have been installed or uninstalled, existence of virtual network adapter or USB drives

138
Q

Process for Investigation with Type 3 Hypervisors

A
  1. Image the host machine
  2. Locate Virtualization software and VMs
  3. Export from ost machine all VM files
  4. Record hash of all files
  5. Open VM as image file in forensics software and create a forensic image or mount as drive
139
Q

Why are live acquisitions of VMs importabt

A

Make sure snapshots are incorporated

140
Q

Mounting VM as external drive features

A

Make it behave more like physical computer, use same standard examination procedures for static drive

141
Q

Other VM Examination Methods

A

Mount VMs as external drive, make copy of VM forensic image and open the copy while it is running

142
Q

Where are type 1 hypervisors installed

A

Directly on hardware

143
Q

Type 1 Hypervisors

A

VMware vSphere, Microsoft Hyper-V 2016, XenProject XenServer, IBM PowerVM, Parallels Desktop for MAC

144
Q

Order of Volatility

A

How long a piece of information lasts on a system

145
Q

When are live acquisitions especially useful?

A

When dealing with active network intrusions of attacks (must be before taking system offline)

146
Q

Steps of Live Acquisition

A
  1. Create bootable forensic CD or USB
  2. Log all actions
  3. Send info to network drive
  4. Copy RAM
  5. Varies based on incident
  6. Get hash value of all files recovered
147
Q

Tools to Capture RAM

A

Mandiant Memoryze, Belkasoft RamCapturer, Kali Linux

148
Q

Network Forensics

A

Process of collecting and analyzing raw network data and tracking network traffic

149
Q

What is an important part in spotting variations in network traffic

A

Knowing network’s typical traffic patterns

150
Q

Need for Established Procedures

A

Necessary for ensuring all compromised systems have been found, must be based on needs and complement network infrastructure

151
Q

Layered Network Defense Strategy

A

Sets up layers of protection to hide the most valuable data at the innermost part of the network

152
Q

Defense in Depth (DiD)

A

Modes of protection: people, technology, operations

153
Q

Are security precautions against internal threats necessary for companies with less than ten people

A

Yes

154
Q

Testing ____ is as important as testing servers

A

Networks

155
Q

Networks forensics standard procedures

A
  1. Use standard installation image for systems on network
  2. Fix any vulnerability after attack
  3. Attempt to retrieve all volatile data
  4. Acquire all compromised drives
  5. Compare files on forensic image to original installation image
156
Q

Where can you work from to find most of the deleted or hidden files and partitions

A

The image

157
Q

What do you have to do in order to understand attack

A

Restore drives

158
Q

Tools for examining network traffic

A

Tcpdump and wireshark

159
Q

Network logs record ingoing and outgoing traffic of what

A

Network servers, routers, firewalls

160
Q

Network tools

A

Splunk, spiceworks, Nagios, Cacti

161
Q

Packet analyzers

A

Devices or software that monitor network traffic

162
Q

What level of OSI do packet analyzers work at

A

2 or 3

163
Q

most tools for packet analysis use this format

A

Packet Capture (Pcap)

164
Q

How to identify packets in packet analysis

A

TCP headers (tcpdump or tethereal)

165
Q

packet Analysis Tools

A

Tcpslice, Tcpreplay, Etherape, Netdude, Argus, Wireshark

166
Q

How is virtual switch different than physical switch

A

No spanning tree between virtual switches

167
Q

Complications of Investigating Virtual Networks

A

Hypervisors can assign MAC addresses to virtual devices, devices can have same MAC address on different Virtual Networks, Cloud service providers host networks for several to hundreds of companies

168
Q

Tools for investigating virtual networks

A

Wireshark, network miner

169
Q

DDoS attack

A

Major threat that may go through other organizations’ networks, hundreds or thousands of zombie machines can be used

170
Q

Honeynet Project

A

Make information widely available in attempt to thwart internet and network attackers

171
Q

Zero Day Attacks

A

Attackers look for holes in networks and OSs and exploit these weaknesses before patches are available

172
Q

Honeypot

A

Normal looking computer that lures attackers to it

173
Q

Honeywalls

A

Monitor what’s happening to honeypots on your network and record what attackers are doing

174
Q

When are live acquisitions necessary

A

To retrieve volatile items (RAM, running processes)

175
Q

Items stored on cell phones

A

Calls, Text/Sms, email, IM, web pages, pictures, videos, music, Calendars, social media info, gps data, voice recordings, back account, access to home

176
Q

Are warrants required for mobile devices

A

Yes

177
Q

Is there a standard for how and where phones store messages

A

No, makes investigating them difficult

178
Q

Generations of Phones

A

Analog, Digital personal communication service, Third generation (3G)

179
Q

When was fourth generation introduced

A

2009

180
Q

when was fifth generation finalized

A

2020

181
Q

Code Division Multiple Access

A

Conform to IS-95, referred to as CDMA1, when 3G became CDMA2000

182
Q

What technique for Global System for Mobile Communications

A

Time division Multiple access, multiple phones take turns sharing a channel

183
Q

International Telecommunications Union

A

Developed 3G under UN

184
Q

What standard was developed specifically for 3G

A

Enhanced Data GSM Environment

185
Q

4G Network Technologies

A

Orthogonal Frequency Division Multiplexing, Mobile WiMAX, Ultra Mobile Broadband, Multiple input multiple output, long term evolution

186
Q

Main Components for Mobile Communication

A

Base transceiver station, Base station controller, mobile switching center

187
Q

Hardware components of mobile devices

A

Microprocessor, ROM, RAM, digital signal processor, radio module, microphone and speaker, hardware interfaces, LCD display

188
Q

Do smartphones use same OSs and PCs

A

Yes, but it is proprietary

189
Q

Where do phones store data

A

Electronically erasable programmable read-only memory (EEPROM)

190
Q

Why do phones store data in EEPROM

A

Enables service providers to reprogram phones without having to physically access memory chips

191
Q

Where is OS stored

A

ROM

192
Q

PDA

A

Personal digital assistants, mostly irrelevant

193
Q

Peripheral memory cards used with PDAs

A

Compact Flash, Multimedia Card, Secure Digital

194
Q

SIM

A

Subscriber identity module

195
Q

Where are sim cards found

A

GSM devices

196
Q

What do SIM cards consist of

A

Microprocessor and internal memory

197
Q

How many sizes do SIM cards come in

A

3

198
Q

What makes SIM cards versatile

A

Portability

199
Q

ME

A

Mobile equipment, need SIM card

200
Q

Additional purposes of SIM card

A

Identifies subscriber, stores service related information, can be used to backup device

201
Q

What do phones include for external storage

A

SD cards

202
Q

3 main concerns of mobile devices

A

Loss of power, syncing with cloud, remote wiping

203
Q

What type of memory do mobile devices have

A

Volatile

204
Q

If mobile device attached to PC what should be done and why

A

Disconnect to prevent syncing that might occur automatically and overwrite data

205
Q

How can you isolate device from incoming signals

A

Airplane mode, pain can, faraday bag, turn off

206
Q

Downside of isolating device

A

Drains battery

207
Q

SANS DFIR Forensics Recommendation if device on and unlocked

A

Isolate from network, disable lock screen, remove passcode

208
Q

SANS DFIR Forensics recommendation if on and locked

A

Depends on type of device

209
Q

SANS DFIR Forensics Recommendation if off

A

Physical static acquisition and turn device on

210
Q

What areas to check in forensics lab

A

Internal memory, SIM, removable or external memory cards, network provider

211
Q

Complication of warrant or subpeona

A

Backup might be stored in cloud or with third party

212
Q

Structure of SIM file system

A

Hierarchial

213
Q

Categories of information retrieved

A

Service data, call data, message information, location information

214
Q

What might be required if power to device is lost

A

PINs or other access codes

215
Q

Biggest challenge of mobile forensics

A

Constantly changing phone models

216
Q

Procedure for working with mobile device

A
  1. Identify device
  2. Make sure you have installed mobile device forensic software
  3. Attach phone to power and connect cables
    Start forensics software and download information
217
Q

What is used to access SIM card

A

Combination of hardware and software devices

218
Q

Are all SIM card readers forensically sound

A

No

219
Q

Should you document messages that haven’t been read yet

A

Yes

220
Q

Mobile phone forensics tools

A

AccessData FTK Imager, MacLockPick 3.0

221
Q

Types of mobile forensics methods

A

Manual, logical, physical, hex dumping and joint test action group, chip-off, micro read

222
Q

Datapilot

A

Collection of cables that can interface with phones from different manufacturers

223
Q

BitPam

A

Used to view data on many CDMA phones

223
Q

Cellbrite UFED Forensic System

A

works with smartphones, PDAs, Tablets, and GPS devices, often used by law enforcement

224
Q

MOBILedit Forensic

A

Contains built in write blocker

225
Q

Are tools used to edit information forensically sound

A

Not typically

226
Q

Options for data extraction

A

Logical, file system, physical

227
Q

What is required if you connect a mobile device to a computer to browse file system and examine and retrieve files

A

USB write-blocker

228
Q

Projected number of IoT devices in next few decades

A

50 billion

229
Q

What is IoE

A

Internet of everything, includes non-tangible but widespread technology

230
Q

What is IoA

A

Includes cars, homes, pets, livestock, and applications for making all these things work together, eventually 5G devices

231
Q

5G Devices Categories

A

Enhanced mobile broadband, ultra-reliable and low latency communications, massive machine type communications

231
Q

New forensic challenges of 5G devices

A

People to device, device to device, device to cloud

231
Q

What service led the way to cloud

A

Salesforce.com

232
Q
A
233
Q

Who came up with cloud computing

A

John McCarthy and DR. J.C.R. Licklider

234
Q

Amazon Mechanical Turk

A

2002, storage, computations, and human intelligence

235
Q

What year and after which web version did providers start their own cloud services

A

2009, 2.0

236
Q

What is cloud computing

A

Computing storage system that provides on-demand network access for multiple users and can allocate storage to users to keep up with changes in their needs

237
Q

Service levels of Cloud

A

Software as a Service, Platform as a Service, Infrastructure as a Service

238
Q

Software as a Service

A

Applications are delivered via the internet

239
Q

Platform as a service

A

An OS has been installed on a cloud server

240
Q

Infrastructure as a Service

A

Customers can rent hardware and install whatever OSs and applications they need

241
Q

Deployment methods for a cloud

A

Public, private, community, hybrid

242
Q

Some cloud service providers (CSP)

A

Salesforce, Cisco cloud computing, IBM cloud, Amazon EC2, AT&T Synaptic, Google Cloud Storage, HP Helion, Microsoft Azure, XenServer and XenCenter Windows Management Console, Rackspace, Oracle cloud

243
Q

What is cloud forensics a subset of

A

Digital forensics

244
Q

Dimensions of Cloud Forensics

A

Organizational, legal, technical

245
Q

Organizational Dimension

A

address structure of cloud

246
Q

Legal Dimension

A

Covers service agreements and other jurisdictional matters

247
Q

Technical Dimension

A

Deals with procedures and specialized applications designed to perform forensics recovery and analysis in the cloud

248
Q

Forensic Data Collection for cloud

A

Must be able to identify, label, record, and acquire data from the cloud

249
Q

Elastic, static, and live forensics for cloud

A

Must be able to expand and contract their storage

250
Q

Evidence segregation for cloud

A

Different businesses and users share the same applications and storage space

251
Q

Investigations in virtualized environments for cloud

A

Should have capability to examine virtual systems

252
Q

Cloud Service agreements

A

Contract between CSP and the customer that describes what services are being provided and at what level

253
Q

CSAs also specify

A

Support options, penalties for services not provided, system performance, fees, provided software or hardware

254
Q

What do CSAs define

A

Scope of services the CSP provide (service hours, restrictions to the customer, response time for data transfers, throughput limitations, contingency plan for incident response, business continuity and disaster recovery plan, fees, security measures, terminology)

255
Q

What must CSP components state

A

Who is authorized to access data and what the limitations are in conducting acquisitions for an investigation

256
Q

Policies for CSPs

A

detailed rules for CSPs internal operation

257
Q

Standards for CSPs

A

Give guidance to staff for unique operations, hardware, and software and describe the staff’s obligations regarding security of CSP env

258
Q

Guidelines for CSPs

A

Describe best practices for cloud processes and give staff an example of what they should strive to achieve in their work

259
Q

What are CSP processes and procedures

A

Detailed documents that define workflow and step-by-step instructions for CSP staff (often with hardware config, network maps, application flow charts)

260
Q

What are CSP Processes and Procedures used for by digital forensics examiners

A

Understand how data is stored, manipulated, secured, backed up, restored, and accessed by CSP staff and customers

261
Q

What is an example of a document of interest

A

CSP Business continuity and disaster recovery plans

262
Q

Is there a law that ensures uniform access or required handling procedures for the cloud

A

No

263
Q

What should investigators be concerned about

A

Cases involving data commingled with other customers’ data

264
Q

What is a factor in problems with right to access data

A

How privacy rights are defined in different jurisdictions

265
Q

EU Directive 95/46/EC

A

Protects private information for all EU citizens, more restrictive than rules in other countries

266
Q

Can digital forensics investigators be held liable when conducting an investigation involving cloud data

A

Yes

267
Q

ECPA

A

Electriconic Communications Privacy Act

268
Q

ECPA mechanisms (5)

A

Search warrants, subpoenas, subpoenas with prior notice to customer, court orders, court orders with prior notice to customer

269
Q

Search Warrants

A

Only issued in criminal cases, requires probable cause, specific descriptions of what is to be seized, typically data in the case of cloud, must include location, how carried out

270
Q

Government Agency Subpoenas

A

Customer communications and records. can’t be knowingly divulged to any person or entity

271
Q

non-government and civil litigation subpoenas

A

Used to produce information from private parties for litigation

272
Q

Court Orders

A

Written by judges to compel someone to do or not so something

273
Q

Challenges in conducting cloud forensics

A

Architecture, data collection, analysis of cloud forensic data, anti-forensics, incident first responders, role managements, legal issues, standards and training

274
Q

Are CSPs configured the same way as any othe CSP

A

No

275
Q

Where do CSPs keep data

A

Often kept secret for security reasons

276
Q

What can complicate the chain of evidence of an investigation

A

Differences in recording procedures or log keeping

277
Q

What does analyzing digital evidence from a cloud require

A

verifying data with other data and other log records

278
Q

What might need to happen to data so that investigators can determine what actually occured

A

Reconstruction

279
Q

What can be compared using logs

A

modifications, las access, create dates and times

280
Q

Anti-forensics

A

Destroying electronically stored information (ESI) that may be potential evidence

281
Q

Methods for anti-forensics

A

Malware, encryption of malware, data-hiding

282
Q

How do anti-forensic methods affect file metadata

A

Changing modify and last access date

283
Q

How can you determine what files may have been altered

A

Compare hash values of files to those of known good files

284
Q

factors in incident first response, if not already part of CSP

A

CSPs staff cooperation, brief about security options, train staff in evidence collection

285
Q

Functions of Role management in cloud covers

A

Data owners, identity protection, users, access controls

286
Q

CSA

A

Cloud Security Alliance, develops resource documentation for CSPs and their staff

287
Q

What is there an effort to standardize cloud architecture for

A

Operating procedures, interoperability, testing, validation

288
Q

Sources for cloud forensics training

A

(ISC)^2’s Certified Forensics Professional, INFOSEC Institute, SANS Cloud Forensics with F-Response, National Institute of Justice Digital Forensics Training, University College Dublin Centre for Cybersecurity and Cybercrime Investigation

289
Q

What do methods to collect evidence count on

A

The nature of the case

290
Q

Why might recovering deleted data be limited

A

The type of file the CSP uses

291
Q

States of data in the cloud

A

reset and motion

292
Q

Data at rest

A

Data that has been written to disk

293
Q

Data in motion

A

Data being transmitted over a network

294
Q

Vendors for cloud data encryption

A

Atalla, SecureCloud, Safeguard

295
Q

Homomorphic Encryption

A

Use an ‘ideal lattice’ mathematical formula to encrypt data

296
Q

Where can you find cloud data if the application is not installed

A

Web Cache

297
Q

Prefetch file

A

contain the DLL pathnames and metadata of an application

298
Q

Where is the prefetch file loaded once OS reads it

A

Computer’s memory

299
Q

Widely used cloud services

A

Dropbox, Google Drive, One Drive

300
Q
A

CPEG495 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions