Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Final > Flashcards

Final Flashcards

1
Q

Forensics

A

The use of science and technology to investigate and establish facts in criminal or civil courts of law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Relevant evidence

A
  1. tendency to make a fact more or less probable then it would be without evidence. 2. the fact is of consequence in determining the action.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

digital evidence

A

information of probative value stored or transmitted in digital form

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

digital media

A

physical objects where data is stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

computer use in crime

A

contraband, tool for the crime, incidental to the Crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

contraband

A

digital equipment etc was illegally obtained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

tool of crime

A

hacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

incidental to the crime

A

digital media has evidence of the crime(phone contacts etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

types of investigations

A

internal, civil, criminal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

daubert standard

A

judge makes a call on if the scientific expert is basing their reason on proven scientific methodology. Daubert challenge is if you use anything thats not accepted by a majority of professionals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Locard’s principle of Transference

A

you can’t interact with an environment without leaving something behind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Inman-Rudin Paradigm

A

transfer, identification, individualization (narrowing evidence to certain classification), association (linking to a person or system), reconstruction (what happened), sixth principle (evidence must divide before transfer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

cross validation

A

any forensic artifact must be discoverable with multiple tools and techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

6 As

A

Assessment (gathering information, chain of custody, determine scope, protect media), acquisition (make the copy of the data), authentication (verify copies), analysis (looking for the artifacts), articulation (drafting and submitting the report), archival (Storage of media, notes, and report).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are hashes used for

A
  1. determining if data is unique. 2. determine if data is the same. 3. determine if any changes have been made to the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Floppy disk life span

A

2 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CD-RW life span

A

3 years or up to 50 with proper storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

USB drive life span

A

up to 10 if not heavily used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

hard drive life span

A

up to 34 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

evidence

A

ANY INFORMATION OF PROBATIVE VALUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Best Evidence

A

most complete copy of evidence that was obtained that is most closely linked to the original evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Computer components that hold evidence

A

hard drives, removable media, RAM (has to be collected through live analysis), motherboard BIOS, scanners, printers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Network devices that hold evidence

A

clients, servers, routers, gateways, firewalls, network printers, NAS (network attached storage)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

magnetized media

A

holds a series of charges. Pro: very large storage capacity, data can be overwritten without being reset. Cons: slow access time, slow random read and write

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Hard Drive Physical components

A

platters (magnetized surface containing charge), Read/Write heads (electromagnets used for reading or changing charges), Arm (moves read/write head towards the inside of the disk)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Hard Drive Logical Components

A

Tracks-rings that go completely around the center of the platter. Cylanders- tracks that line up on parallel platters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Hard Drive Sectors

A

Pie-Shaped wedge tracks (a sector is the smallest unit of data that can be read or written from magnetic storage media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Two Hard Drive Interfaces

A

IDE and SATA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Floppy disk forensics

A

treat like a single platter hard drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

magnetic media forensics

A

never truly wiped, data isn’t erased before overwritten

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

optical media forensics

A

cd-rom, blue ray disk, DVD-rom. (inherently read only), writing data must be done to the entire disk at once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

RAID

A

Redundant array of independent disks - used to prevent hardware failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

RAID Levels

A

0 - block stripping (data distributed among multiple drives) one drive fails all fail. 1 - disk mirroring data written to two disks simultaneously. onE disk fails the other comes online. 2- disk mirroring with ECC (NOT USED). 3- Byte stripping with parity. 4- block stripping with parity drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Three RAID implementations

A

Internal Hardware (RAID controller card), external hardware (enclosure in a separate cabinet), software, cannot boot off a software RAID volume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How to acquire RAID data?

A

boot the suspect computer into a forensically sound environment and acquire raid volume. In encase: device view, select drives, edit disk config, specify RAID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

SSDs

A

uses modified transistors for non-volatile storage, very fast data access, issues with recovering deleted data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Assembly

A

low level language for microprocessors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

order of memory speed

A

registers, caches, main memory, disk storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

4 kinds of memory

A

Internal (registers and CPU cache), main memory (RAM), on-line mass storage (Hard drive, ssd, usb), offline bulk storage (tape arrays)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Computer Busses

A

single copper wire can transfer electrons, a bunch of wires doing this is a bus. Motherboards contain busses to communicate.

41
Q

Power On

A
  1. self test 2. microprocessor does ROM BIOS, microprocessor begins executing attached bios code, 4. POST, 5. BIOS locates CMOS (stores boot order etc), loads the OS
42
Q

BIOS vs EFI

A

BIOS was the original way to interface with motherboard, EFI is the new replacement it has better GUI, multi language support, full networking, fully modular

43
Q

Two Forensics systems’ roles

A

Aquisition/duplication (make the copy), Analysis (parse it)

44
Q

write blocker

A

device that stops the host system from sending a write signal to any connected device

45
Q

Forensic Drive duplicator

A

device that makes a forensic image

46
Q

Forensic Software

A

encase, SMART (asr data), FTK (windows), paraben, GetData, Blackbag

47
Q

How to collect BIOS information

A
  1. start computer with no drives. 2. hit a function key to load bios or ufi, record system date and time, record the boot order.
48
Q

things that can ruin a forensic image

A
  1. Booting drive into Windows without write protection.. 2. using an unmodified boot disk. 3. mounting the drive as read/write in linux, choosing the wrong drive as source or destination.
49
Q

How are files stored on a disk?

A

files store bytes at a low level. bytes are displayed as hexadecimal. 2 hex digits for each byte.

50
Q

Standard file metadata

A

FAT, file name, extension, attributes, creation date and time, access date, modification date and time

51
Q

partition

A

set of consecutive sectors on a disk

52
Q

Volume

A

partition with a single file system

53
Q

initializing a disk

A

writes information in the beginning of the disk at the first physical sector

54
Q

formatting a disk

A

writing a file system onto a partition. Turning a partition into a volume.

55
Q

file system

A

organizes data on a disk. FAT & NTFS are cluster. EXT2,3,4 are Block. Keeps track of file allocation and file metadata.

56
Q

FAT

A

File Allocation Table. For floppy disks, uses a file allocation table which keeps track of clusters.

57
Q

FAT Directory

A

A file that contains a listing of the contents of the directory (directory table)

58
Q

Where is the root directory stored?

A

FAT VBR

59
Q

How to undelete a FAT file

A

go through the directory table, follow the cluster chain in FAT, and see if the clusters have the appropriate data. (When the file is deleted the entry is marked deleted)

60
Q

How to undelete NTFS file

A

MFT contains a master record of every file on the drive, when a file is deleted it is marked as deleted, undeleting is changing the mark from deleted to not-deleted on the master record.

61
Q

Linux File Systems

A

Ext2 (disk broke into partitions and groups) Inode table and bitmap. Ext3 same as before but with journaling - read and writes are done all at once or not at all. Ext4- large file size, better performance.

62
Q

Inode

A

pointer. It points to a block on the disk.

63
Q

Raw duplicate

A

exact binary copy from one disk to another. Fastest way to make a copy. Drawbacks: must use write blocker on copy at all times, must verify copy has not been altered, must treat entire disk as evidence

64
Q

DD image file

A

contains the exact binary of the evidence disk. Ad: everything can read it, fast to create, can be segmented. Dis: no way to detect changes without re verification, metadata not stored.

65
Q

Encase Image File

A

allows for compression and encryption of data, ad: single bit changes can be isolated. Dis: slower to create then dd file.

66
Q

What are operating systems responsible for?

A

input/output, data management through file systems, Networking, memory, peripheral device management

67
Q

multiuser

A

simultaneous users can run programs

68
Q

multiprocessing

A

OS can run multiple processes on multiple processors

69
Q

multitasking

A

OS can run concurrent programs on single processor

70
Q

multi-threading

A

OS allows programs to be broken down into threads and run independently and dependently

71
Q

OS kernal

A

low level input and output, handware interfaces, memory management, allows for program execution.

72
Q

Interrupts

A

signal sent by hardware device to the kernal indicating that it needs attention

73
Q

API

A

Application program interface. Allows programs to interact with the OS

74
Q

How to recover a partition

A

look for the volume boot sector, for FAT and NTFS 55 AA

75
Q

Master boot record location

A

On the first sector of the drive

76
Q

Windows 7 App Data

A

Local (app data specific to computer) Local Low (internet browsers), Roaming (application data from a user account accross domain)

77
Q

Windows swapfile

A

for when many things are open. Part of virtual memory, pagefile.sys

78
Q

printer spool file

A

windows/system32/spool/printers

79
Q

unallocated space

A

when a file is deleted in windows the clusters get grouped into the space available for file allocation

80
Q

slack space

A

space between the logical end of the file and the actual end of the file

81
Q

Recycle Bin

A

Everytime a file is deleted into the recycle bin two files are created $R (deleted file) and $I (metadata) preceding.

82
Q

What times does windows track?

A

Created, Modified, accessed

83
Q

FAT time stamps

A

stored in directory entries, stored in local time according to bios. If file is MOVED all times stay same. If file is copied all stay the same but the created.

84
Q

NTFS

A

times stored UTC, registry settings for which the timezone is located, displayed times are based on stored times. If copied the created time changes and the accessed time, if moved the accessed time changes.

85
Q

What if a FAT file has a created time after the modified and accessed time stamps?

A

file is a copy of another file

86
Q

What if a FAT file is moved to NTFS? (time stamps)

A

accessed date changes. If copied then both the access date and the created date would change. (follows the rule of NTFS)

87
Q

What if an NTFS file is moved to FAT? (Time stamps)

A

moved changes the accessed date. Copied would change the created and access date.

88
Q

Registry

A

stores configuration settings and options for the systems and users. all windows specific settings are stored here. Key: container for either another key or value. Value: name and data (discriptors, bits, strings)

89
Q

7 registry root keys

A

HKLM(local machine), HKCC(current config), HKCR(classes root), HKCU(current user), HKU (users),HKEY_performace_data, HKEY_dynamic_data.

90
Q

Windows NT based registry locations

A

systemroot/system32/config - SAM, SECURITY, SOFTWARE, SYSTEM. also userprofile\ntuserdat

91
Q

Windows USB device installation (registry)

A

windows\inf\usbstor.inf

92
Q

DeviceInstanceID gives access to this registry key:

A

SYSTEM\CurrentControlSet\Enum\USB

93
Q

How to find first time a USB was attached?

A

setupapi log (under inf)

94
Q

How to find each time USB was attached?

A

enum/USB or enum/USBSTOR keep a permanent record of each USB attached. The last written time stamp is the last attachment

95
Q

Internet Cache

A

allows a user to return to a website quickly if there is no new content

96
Q

cookies

A

tracks user activity, stores session ID

97
Q

where is internet data in directory?

A

documents and settings\username\appdata. Local (has history, cache, cookies), Local Low, roaming

98
Q

email header

A

tells you the servers or routers the email took to get to you

99
Q

User assist registry

A

ntuserdat - \Software\Microsoft\Windows\currentversion\explorer\userassist. Gives what programs or shortcuts a user has executed, time stamps, frequency of running a particular program (but not how many times it has been run).

Digital Forensics (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions