Final Exam Flashcards
1
Q
By the 1970s electronic crimes were increasing especially in the financial sector.
A
True
2
Q
To be a successful computer forensics investigator you must be familiar with more than one computing platform.
A
True
3
Q
Computer investigations and forensics fall into the same category: public investigations.
A
False
4
Q
The law of search and seizure protects the rights of all people excluding people suspected of crimes.
A
False
5
Q
After a judge approves and signs a search warrant, it’s ready to be executed, meaning you can collect evidence as defined by the warrant.
A
True
6
Q
Maintaining credibility means you must form and sustain unbiased opinions of your cases.
A
False
7
Q
The definition of digital forensics has evolved over the years from simply involving securing and analyzing digital information stored on a computer for use as evidence in civil, criminal, or administrative cases.
A
True
8
Q
The Fourth Amendment to the U.S. Constitution (and each state’s constitution) protects everyone’s rights to be secure in their person, residence, and property from search and seizure.
A
True
9
Q
When you work in the enterprise digital group you test and verify the integrity of standalone workstations and network servers.
A
False
10
Q
The police blotter provides a record of clues to crimes that have been committed previously.
A
True
11
Q
Which entity was formed by the FBI in 1984 to handle the increasing number of cases involving digital evidence?
A
Computer Analysis and Response Team (CART)
12
Q
A technician is trying to recover information on a computer that has been hidden or deleted on purpose in order to hide evidence of a crime. Which type of task is the technician performing?
A
Data recovery
13
Q
Which group often works as part of a team to secure an organization’s computers and networks?
A
Forensic investigators
14
Q
Which group manages investigations and conducts forensic analysis of systems suspected of containing evidence related to an incident or a crime?
A
Digital investigations
15
Q
Which agency introduced training on software for forensics investigations by the early 1990s?
A
IACIS
16
Q
Which Pacific Northwest agency meets to discuss problems that digital forensics examiners encounter?
A
CTIN
17
Q
Which type of case involves charges such as burglary, murder, or molestation?
A
Criminal
18
Q
What is the third stage of a criminal case after the complaint and the investigation?
A
Prosecution
19
Q
What does the investigator in a criminal or public-sector case submit at the request of the prosecuting attorney if he or she has enough information to support a search warrant?
A
Affidavit
20
Q
When an investigator seeks a search warrant which of the following must be included in an affidavit to support the allegation of a crime?
A
Probable cause?
21
Q
What must be done under oath to verify that the information in the affidavit is true?
A
It must be notarized
22
Q
What do published company policies provide for a business that enables them to conduct internal investigations?
A
Line of authority
23
Q
What usually appears when a computer starts or connects to the company intranet network or virtual private network (VPN) and informs end users that the organization reserves the right to inspect computer systems and network traffic at will?
A
Warning banner
24
Q
What term refers to a person using a computer to perform routine tasks other than systems administration?
A
End user
25
Which term refers to an accusation or supposition of fact that a crime has been committed and is made by the complainant based on the incident?
Allegation
26
Without a warning banner what right might employees assume they have when using a company's computer systems and network accesses?
Privacy
27
What term refers to the individual who has the power to conduct digital forensic investigations?
Authorized requester
28
What is most often the focus of digital investigations in the private sector?
Misuse of digital assets
29
Which doctrine found to be unconstitutional was used to allow a civilian or private-sector investigative agent to deliver evidence obtained in a manner that violated the Fourth Amendment to a law enforcement agency?
Silver platter
30
A forensics analysis of a 6 TB disk for example can take several days or weeks.
True
31
Requirements for taking the EnCE certification exam depend on taking the Guidance Software EnCase training courses.
False
32
If damage occurs to the floor walls ceilings or furniture in your computer forensics lab it does not need to be repaired immediately.
False
33
A good working practice is to use less powerful workstations for mundane tasks and multipurpose workstations for the higher-end analysis tasks.
True
34
Computing systems in a forensics lab should be able to process typical cases in a timely manner.
True
35
By using marketing to attract new customers or clients you can justify future budgets for the lab's operation and staff.
True
36
The ANSI-ASQ National Accreditation Board (ANAB) is a wholly owned subsidiary of the American Society of Crime Laboratory Directors (ASCLD).
False
37
The lab manager sets up processes for managing cases and reviews them regularly.
True
38
For daily work production several examiners can work together in a large open area as long as they all have different levels of authority and access needs.
False
39
Chapter 5 Section 3 of the NISPOM describes the characteristics of a safe storage container.
True
40
At what location does the forensics investigator conduct investigations, store evidence, and do most of his or her work?
Digital forensics lab
41
At what levels should lab costs be broken down?
Monthly, quarterly, and annually
42
What reports are generated at the local state and federal levels to show the types and frequency of crimes committed?
Uniform crime reports
43
In addition to FAT16, FAT32, and Resilient File System which file system can Windows hard disks also use?
NTFS
44
What organization was created by police officers in order to formalize credentials for digital investigators?
IACIS
45
How frequently does IACIS require recertification to demonstrate continuing work in the field of computer forensics?
Every three years
46
What HTCN certification level requires candidates have three years of experience in computing investigations for law enforcement or corporate cases?
Certified Computer Forensic Technician, Basic (CCFT-B)
47
What kind of forensic investigation lab best preserves the integrity of evidence?
A secure facility
48
At what distance can the EMR from a computer monitor be picked up?
1/2 mile
49
During the Cold War defense contractors were required to shield sensitive computing systems and prevent electronic eavesdropping of any computer emissions. What did the U.S. Department of Defense call this special computer-emission shielding?
TEMPEST
50
What material is recommended for secure storage containers and cabinets?
Steel
51
How frequently should floors and carpets in the computer forensic lab be cleaned to help minimize dust that can cause static electricity?
Once a week
52
Which resource can be helpful when investigating older and unusual computing systems?
AICIS lists
53
What type of plan specifies how to rebuild a forensic workstation after it has been severely contaminated by a virus from a drive you're analyzing?
Disaster recovery plan
54
Where should your computer backups be kept?
Off-site
55
What process refers to recording all the updates made to a workstation?
Configuration management
56
Methods for restoring large data sets are important for labs using which type of servers?
RAID
57
Which activity involves determining how much risk is acceptable for any process or operation?
Risk management
58
What is the maximum amount of time computing components are designed to last in normal business operations?
36 months
59
In what process is the acquisition of newer and better resources for investigation justified?
Building a business case
60
If the computer has an encrypted drive a live acquisition is done if the password or passphrase is not available.
True
61
The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your disk-to-image file.
True
62
Some acquisition tools don't copy data in the host protected area (HPA) of a disk drive.
True
63
FTK Imager requires that you use a device such as a USB dongle for licensing.
False
64
Unlike RAID 0, RAID 3 stripes tracks across all disks that make up one volume.
False
65
In Autopsy and many other forensics tools, raw format image files don't contain metadata.
True
66
Similar to Linux, Windows also has built-in hashing algorithm tools for digital forensics.
False
67
A separate manual validation is recommended for all raw acquisitions at the time of analysis.
True
68
Acquisitions of RAID drives can be challenging and frustrating for digital forensics examiners because of how RAID systems are designed, configured, and sized.
True
69
There's no simple method for getting an image of a RAID server's disks.
True
70
Which type of format acquisition leaves the investigator unable to share an image between different vendors' computer forensics analysis tools?
Proprietary
71
What type of acquisition is typically done on a computer seized during a police raid?
Static
72
What type of acquisition is done if the computer has an encrypted drive and the password or passphrase is available?
Live
73
What is the most common and flexible data-acquisition method?
Disk-to-image
74
If your time is limited, what type of acquisition data copy method should you consider?
Logical or sparse
75
By what percentage can lossless compression reduce image file size?
50%
76
What did Microsoft add to its newer operating systems that makes performing static acquisitions more difficult?
Whole disk encryption
77
What term refers to Linux ISO images that can be burned to a CD or DVD?
Linux live CD
78
What command displays pages from the online help manual for information on Linux commands and their options?
man
79
What command creates a raw format file that most computer forensics analysis tools can read?
dd
80
What command works similarly to the dd command but has many features designed for computer forensics acquisitions?
dcfldd
81
In addition to md5sum which hashing algorithm utility is included with current distributions of Linux?
sha1sum
82
What option is used with the dcfldd command to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512?
hash
83
What does Autopsy use to validate an image?
MD5
84
What older Microsoft disk compression tool eliminates only slack disk space between files?
DriveSpace
85
In addition to RAID 0, what type of RAID configuration is available for Windows XP 2000 and NT servers and workstations?
RAID 1
86
In which RAID configuration do two or more disk drives become one large volume so the computer views the disks as a single disk?
RAID 0
87
Which RAID configuration also called mirrored striping is a combination of RAID 1 and RAID 0?
RAID 10
88
Which RAID configuration offers the greatest access speed and most robust data recovery capability?
RAID 10
89
What type of acquisition is used for most remote acquisitions?
Live
90
ISPs can investigate computer abuse committed by their customers.
True
91
If you follow police instructions to gather additional evidence without a search warrant after you have reported the crime you run the risk of becoming an agent of law enforcement.
True
92
A judge can exclude evidence obtained from a poorly worded warrant.
True
93
The reason for the standard practice of securing an incident or crime scene is to expand the area of control beyond the scene's immediate location.
True
94
Corporate investigators always have the authority to seize all computer equipment during a corporate investigation.
False
95
The most common computer-related crime is check fraud.
True
96
Private-sector organizations include small to medium businesses, large corporations, and non-government organizations (NGOs) which always get funding from the government or other agencies.
False
97
Some cases involve dangerous settings. For these types of investigations you must rely on the skills of hazardous materials (HAZMAT) teams to recover evidence from the scene.
True
98
If a company does not publish a policy stating that it reserves the right to inspect computing assets at will or display a warning banner employees have an expectation of privacy.
True
99
When an investigator finds a mix of information, judges often issue a limiting phrase to the warrant which allows the police to present all evidence together.
False
100
When federal courts are evaluating digital evidence from computer-generated records what exception is applied to hearsay?
Business-records exception
101
Under what circumstances are digital records considered admissible?
If they qualify as business records
102
What type of records are considered data that the system maintains such as system log files and proxy server logs?
Computer-generated records
103
When was the Freedom of Information Act originally enacted?
1967
104
Which is the most accurate statement about investigating and controlling computer incident scenes in private-sector environments as compared to crime scenes?
Investigating and controlling the scene is much easier in private sector environments.
105
At a minimum what do most company policies require that employers have in order to initiate an investigation?
Reasonable suspicion that a law or policy is being violated
106
When confidential business data are included with the criminal evidence what are they referred to as?
Commingled data
107
What standard is used to determine whether a police officer has the right to make an arrest, conduct a personal or property search, or obtain a warrant for arrest?
Probable cause
108
What do law enforcement investigators need in order to remove computers from a crime scene and transport them to a lab?
A warrant
109
In addition to environmental issues, what issues are the investigator's primary concerns when working at the scene to gather information about an incident or a crime?
Safety
110
When recovering evidence from a contaminated crime scene, the investigator should take measures to avoid damage to the drive from overheating. At what temperature should the investigator take action?
80 C
111
What will allow the investigator to arrive at a scene, acquire the needed data, and return to the lab as quickly as possible?
Initial-response field kit
112
Which type of kit should include all the tools the investigator can afford to take to the field?
Extensive-response field kit
113
What type of evidence do courts consider evidence data in a computer to be?
Digital
114
The presence of police officers and other professionals who aren't part of the crime scene-processing team may result in the loss or corruption of data through which process?
Professional curiosity
115
When seizing computer evidence in criminal investigations which organization's standards should be followed?
Department of Justice
116
Power should not be cut during an investigation involving a live computer unless it is what type of system?
Older Windows or MS-DOS
117
What type of files might lose essential network activity records if power is terminated without a proper shutdown?
Event log
118
Which technique can be used for extracting evidence from large systems?
Sparse acquisition
119
What is required for real-time surveillance of a suspect's computer activity?
Sniffing
120
The type of file system an OS uses determines how data is stored on the disk.
True
121
One way to examine a partition's physical level is to use a disk editor such as WinHex or Hex Workshop.
True
122
As data is added the MFT can expand to take up 75% of the NTFS disk.
False
123
The first 5 bytes (characters) for all MFT records are FILE.
False
124
Alternate data streams can obscure valuable evidentiary data intentionally or by coincidence.
True
125
Typically a virtual machine consists of just one file.
False
126
From a network forensics standpoint there are no potential issues related to using virtual machines.
False
127
In Microsoft file structures, sectors are grouped to form clusters which are storage allocation units of one or more sectors.
True
128
Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack.
True
129
It's possible to create a partition, add data to it, and then remove references to the partition so that it can be hidden in Windows.
True
130
What term refers to a column of tracks on two or more disk platters?
Cylinder
131
How do most manufacturers deal with a platter's inner tracks having a smaller circumference than its outer tracks?
Zone bit recording (ZBR)
132
What term refers to the number of bits in one square inch of a disk platter?
Areal density
133
Which acronym refers to the file structure database that Microsoft originally designed for floppy disks?
FAT
134
Which acronym refers to the file system that was introduced when Microsoft created Windows NT and that remains the main file system in Windows 10?
NTFS
135
What is on an NTFS disk immediately after the Partition Boot Sector?
Master File Table (MFT)
136
What are records in the MFT called?
FILE records
137
In the NTFS MFT all files and folders are stored in separate records of how many bytes each?
1024
138
The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. What are these cluster addresses called?
Data runs
139
What is the name of the optional built-in encryption that Microsoft added to NTFS when Windows 2000 was introduced?
Encrypting File System (EFS)
140
Which certificate provides a mechanism for recovering files encrypted with EFS if there is a problem with the user's original private key?
Recovery certificate
141
When Microsoft created Windows 95, into what were initialization (.ini) files consolidated?
Registry
142
What specifies the Windows XP path installation and contains options for selecting the Windows version?
Boot.ini
143
Which filename refers to a 16-bit real-mode program that queries the system for device and configuration data and then passes its findings to Ntldr?
NTDetect.com
144
Which filename refers to the device driver that allows the OS to communicate with SCSI or ATA drives that aren't related to the BIOS?
NTBootdd.sys
145
What contains instructions for the OS for hardware devices such as the keyboard mouse and video card?
Device Drivers
146
Which filename refers to a core Win32 subsystem DLL file?
Kernel32.dll, Advapi32.dll, User32.dll, Gdi32.dll
147
Which filename refers to the physical address support program for accessing more than 4 GB of physical RAM?
Ntkrnlpa.exe
148
Which filename refers to the Windows XP system service dispatch stubs to executables functions and internal support functions?
Ntdll.dll
149
What enables the user to run another OS on an existing physical computer (known as the host computer) by emulating a computer's hardware environment?
Hypervisor
150
When you research for computer forensics tools, strive for versatile, flexible, and robust tools that provide technical support.
True
151
In software acquisition there are three types of data-copying methods.
False
152
To help determine which computer forensics tool to purchase, a comparison table of functions subfunctions and vendor products is useful.
True
153
Computers used several OSs before Windows and MS-DOS dominated the market.
True
154
After retrieving and examining evidence data with one tool you should verify your results by performing the same tasks with other similar forensics tools.
True
155
Software forensic tools are grouped into command-line applications and GUI applications.
True
156
The validation function is the most challenging of all tasks for computer investigators to master.
False
157
Although a disk editor gives you the most flexibility in testing, it might not be capable of examining a compressed file's contents.
True
158
Because there are a number of different versions of UNIX and Linux these OSs are referred to as CLI platforms.
False
159
Hardware manufacturers have designed most computer components to last about 36 months between failures.
False
160
Which digital forensics tool is categorized as a single-purpose hardware component?
Tableau T35es-R2 SATA/IDE eSATA bridge
161
Where do software forensics tools copy data from a suspect's disk drive?
Image file
162
Which tool enables the investigator to acquire the forensic image and process it in the same step?
Magnet AXIOM
163
What Linux command is used to create the raw data format?
dd
164
Which activity involves sorting and searching through investigation findings to separate good data and suspicious data?
Filtering
165
Many password recovery tools have a feature for generating potential password lists for which type of attack?
Dictionary
166
Which type of copy from the suspect disk to the target location does the simplest method of duplicating a disk drive make?
Physical bit-by-bit copy
167
What must be created to complete a forensic disk analysis and examination?
Report
168
The first MS-DOS tools that analyzed and extracted data from floppy disks and hard disks were used with which type of PC file systems?
IBM
169
In Windows 2000 and later which command shows you the file owner if you have multiple users on the system or network?
Dir
170
Building your own forensics workstation:
requires the time and skills necessary to support the chosen hardware.
171
What do you call a forensics workstation consisting of a laptop computer with almost as many bays and peripherals as a stationary workstation?
portable workstation
172
What type of disk is commonly used with Sun Solaris systems?
SPARC
173
What is the general term for software or hardware that is used to protect evidence disks by preventing data from being written to them?
Write protector
174
Devices used to prevent data from being written to a disk can connect to a computer through FireWire, SATA, PATA, and SCSI controllers as well as which other type of controller?
USB 2.0 and 3.0
175
Which entity publishes articles, provides tools, and creates procedures for testing and validating computer forensics software?
NIST
176
Which standards document demands accuracy for all aspects of the testing process?
ISO 5725
177
Which NIST project manages research on forensics tools?
Computer Forensic Tool Testing (CFTT)
178
What is the primary hash algorithm used by the NIST project created to collect all known hash values for commercial software and OS files?
SHA-1
179
Which type of tool can be used to compare results and verify a new tool by viewing data in its raw format?
Disk editor
180
If a file contains information it always occupies at least one allocation block.
True
181
macOS is built with the new Apple File System (APFS). The current version offers better security encryption and performance speeds, but users can't mount HFS+ drives.
False
182
Some notable UNIX distributions included Silicon Graphics Inc. (SGI), IRIX, Santa Cruz Operation (SCO) UnixWare, Sun Solaris, IBM AIX, and HP-UX.
True
183
Does Windows have a kernel?
Yes
184
The pipe (|) character redirects the output of the command preceding it.
True
185
All disks have more storage capacity than the manufacturer states.
True
186
Before OS X, the Hierarchical File System (HFS) was used in which files are stored in directories (folders) that can be nested in other directories.
True
187
The HFS and HFS+ file systems have four descriptors for the end of a file (EOF).
False
188
Ext3 is a journaling version of Ext2 that has a built-in file recovery mechanism used after a crash.
True
189
In macOS, volume fragmentation is kept to a minimum by removing clumps from larger files.
False
190
Macintosh moved to the Intel processor and became UNIX based with which operating system?
OS X
191
In older versions of macOS, in which fork are file metadata and application information stored?
Resource fork
192
In macOS, in addition to allocation blocks, what kind of blocks do volumes have?
Logical blocks
193
In older versions of macOS where is all information about the volume stored?
Master Directory Block (MDB)
194
What macOS system application tracks each block on a volume to determine which blocks are in use and which ones are available to receive data?
Volume Bitmap
195
In macOS what stores any file information not in the Master Directory Block or Volume Control Block?
Extents overflow file
196
Which term is often used when discussing Linux because technically Linux is only the core of the OS?
Kernel
197
What was the early standard Linux file system?
Ext2
198
What is the largest disk partition Ext4 can support?
1 exabyte
199
What contains file and directory metadata and provides a mechanism for linking data stored in data blocks?
Inodes
200
At what hard link count is a file effectively deleted?
Zero
201
How many components define the file system on UNIX/Linux?
Four
202
Where are directories and files stored on a disk drive?
Data block
203
In Linux in which directory are most system configuration files stored?
/etc/
204
In Linux in which directory are most applications and commands stored?
/usr/
205
On a Linux computer by what are file systems exported to remote hosts represented?
/etc/exports
206
On a Linux computer what contains group memberships for the local system?
/etc/group
207
In a file's inode what are the first 10 pointers called?
Indirect pointers
208
In macOS which fork typically contains data the user creates?
Data fork
209
In macOS, when working with an application file, which fork contains additional information such as menus, dialog boxes, icons, executable code, and controls?
Resource fork
210
Bitmap images are collections of dots or pixels in a grid format that form a graphic.
True
211
Operating systems do not have tools for recovering image files.
False
212
If a graphics file is fragmented across areas on a disk you must recover all the fragments before re-creating the file.
True
213
With many computer forensics tools, you can open files with external viewers.
True
214
Steganography cannot be used with file formats other than image files.
False
215
Under copyright laws, maps and architectural plans may be registered as pictorial, graphic, and sculptural works.
True
216
A graphics program creates and saves one of three types of image files: bitmap, vector, or XIF.
False
217
The Internet is the best source for learning more about file formats and their extensions.
True
218
All TIF files start at position zero (offset 0 is the first byte of a file) with hexadecimal 49 49 3B.
False
219
The two major forms of steganography are insertion and substitution.
True
220
What kinds of images are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes?
Vector
221
What tools are used to create, modify, and save bitmap, vector, and metafile graphics?
Graphics editors
222
Which images store graphics information as grids of pixels?
Bitmap
223
What is the process of converting raw picture data to another format called?
Demosaicing
224
In which format are most digital photographs stored?
Exchangeable Image File (Exif)
225
Which type of compression compresses data permanently by discarding bits of information in the file?
Lossy compression
226
What term refers to recovering fragments of a file?
Carving
227
Which JFIF format has a hexadecimal value of FFD8 FFE0 in the first four bytes?
JFIF
228
If a graphics file cannot be opened in an image viewer what should the next step be?
Examining the header data
229
Which uppercase letter has a hexadecimal value 41?
A
230
From which file format is the image format XIF derived?
TIFF
231
What is the simplest way to access a file header?
Using a hexadecimal editor like WinHex
232
Which header starts with hexadecimal 49 49 2A and has an offset of four bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 64 20 03?
XIF
233
Which term refers to a data-hiding technique that uses host files to cover the contents of a secret message?
Steganography
234
Which data-hiding technique places data from the secret file into the host file without displaying the secret data when the host file is viewed in its associated program?
Insertion steganography
235
Which data-hiding technique replaces bits of the host file with other bits of data?
Substitution steganography
236
What is another term for steganalysis tools?
Steg tools
237
What technique has been used to protect copyrighted material by inserting digital watermarks into a file?
Steganography
238
What type of laws should computer investigators be especially aware of when working with image files in order to avoid infringement violations?
Copyright laws
239
How may computer programs be registered under copyright laws?
As written works
240
The defense request for full discovery of digital evidence applies only to criminal cases in the United States.
True
241
For target drives use only recently wiped media that have been reformatted and inspected for computer viruses.
True
242
Autopsy for Windows cannot perform forensics analysis on FAT file systems.
False
243
Autopsy for Windows cannot analyze data from image files from other vendors.
False
244
When two files look the same when viewed but one has an invisible digital watermark they appear to be the same file except for their sizes.
False
245
Several password-cracking tools are available for handling password-protected data or systems.
True
246
Most organizations keep e-mail for longer than 90 days.
False
247
Some encryption schemes are so complex that the time to crack them can be measured in days, weeks, years, and even decades.
True
248
Private-sector cases such as employee abuse investigations might not specify limitations in recovering data.
True
249
For static acquisitions, remove the original drive from the computer if practical and then check the date and time values in the system's CMOS.
True
250
What does scope creep typically do?
Increases the amount of work required
251
What should be created in order to begin a digital forensics case?
Investigation plan
252
In addition to search warrants what defines the scope of civil and criminal cases?
Subpoenas
253
Which program has an indexed version of the NIST NSRL of MD5 hashes that can be imported to enhance searching for and eliminating known OS and application files?
Autopsy
254
Because digital forensics tools have limitations in performing hashing what tools should be used to ensure data integrity?
Advanced hexadecimal editors
255
Which AccessData feature compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data?
FTK KFF
256
Which activity involves changing or manipulating a file to conceal information?
Data hiding
257
Which Windows disk partition utility can be used to hide partitions?
diskpart
258
The data-hiding technique involving marking bad clusters is more commonly used with what type of file system?
FAT
259
Which term comes from the Greek word for 'hidden writing'?
Steganography
260
When both the original file with no hidden message and the converted file with the hidden message are available what analysis method is recommended by Johnson and Jajodia?
Known cover attack
261
What technology is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure?
Key escrow
262
Which program incorporates an advanced encryption technique that can be used to hide data?
PGP or BestCrypt
263
Which type of recovery is becoming more common in digital forensic analysis?
Password recovery
264
What type of attacks use every possible letter number and character found on a keyboard when cracking a password?
Brute-force
265
Many password-protected OSs and applications store passwords in the form of which type of hash values?
MD5 or SHA
266
Which action alters hash values making cracking passwords more difficult?
Salting
267
What limits the data that can be sought in a criminal investigation?
Search warrant
268
Which data-hiding technique changes data from readable code to data that looks like binary executable code?
Bit-shifting
269
Which hashing algorithm is provided by WinHex?
MD5
270
When intruders break into a network they rarely leave a trail behind.
False
271
Network forensics is a fast easy process.
False
272
Virtual machines are now common for both personal and business use.
True
273
Virtual machines (VMs) help offset hardware costs for companies.
True
274
Type 2 hypervisors cannot be used on laptops.
False
275
Type 1 hypervisors are usually the ones you find loaded on a suspect machine.
False
276
Before attempting to install a type 2 hypervisor you need to enable virtualization in the BIOS before attempting to create a VM.
True
277
In network forensics you have to restore the drive to see how malware that attackers have installed on the system works.
True
278
A honeywall is a computer set up to look like any other machine on your network but it lures the attacker to it.
False
279
Network logs record traffic in and out of a network.
True
280
Which type of forensics can help you determine whether a system is truly under attack or a user has inadvertently installed an untested patch or custom program?
Network forensics
281
Which type of strategy hides the most valuable data at the innermost part of the network?
Layered network defense strategy
282
What type of software runs virtual machines?
Hypervisor
283
Which type of virtual machine software is typically but not exclusively loaded on servers or workstations with a lot of RAM and storage?
Tier 1 hypervisor
284
Which product responded to the need for security and performance by producing different CPU designs?
Intel Virtualization Technology
285
Which program can be used to examine network traffic?
Wireshark, tcpdump
286
Which tool lists all open network sockets including those hidden by rootkits?
Mandiant Memoryze
287
What determines how long a piece of information lasts on a system?
Order of Volatility (OoV)
288
Which network defense strategy developed by the National Security Agency (NSA) has three modes of protection?
Defense in Depth (DiD)
289
Which tool allows network traffic to be viewed graphically?
Etherape
290
Which network protocol analyzer can be programmed to examine TCP headers to find the SYN flag?
tcpdump, tethereal
291
Which tool is useful for extracting information from large Libpcap files?
Tcpslice
292
What are packet analyzers?
Devices or software placed on a network to monitor traffic.
293
On which OSI model layers do most packet analyzers operate?
Two or three
294
Which format can be read by most packet analyzer tools?
Pcap
295
In which type of attack does the attacker keep asking the server to establish a connection?
SYN flood
296
Which tool was designed as an easy-to-use interface for inspecting and analyzing large tcpdump files?
Netdude
297
Which tool probes, collects, and analyzes session data?
Argus
298
Which project was developed to make information widely available in an attempt to thwart Internet and network hackers?
Honeynet
299
What term is used for the machines used in a DDoS attack?
Zombies
300
For digital investigators, tracking intranet e-mail is easier because accounts use standard names the administrator establishes.
True
301
Investigating crimes or policy violations involving e-mail is different than investigating other types of computer abuse and crimes.
False
302
E-mail programs either save e-mail messages on the client computer or leave them on the server.
True
303
All e-mail servers use databases that store multiple users' e-mails.
False
304
Like UNIX e-mail servers, Exchange maintains logs to track e-mail communication.
True
305
Forensic linguistics encompasses civil cases, criminal cases, cyberterrorism cases, and other legal proceedings.
True
306
E-mail crimes and violations rarely depend on the city state and country in which the e-mail originated.
False
307
Evidence artifacts vary depending on the social media channel and the device.
True
308
A challenge with using social media data in court is authenticating the author and the information.
True
309
You can send and receive e-mail in two environments: via the Internet or an intranet (an internal network).
True
310
What name is used for the configuration typically used for e-mail messages that are distributed from a central server to many connected client computers?
Client-server
311
In an e-mail address what symbol separates the domain name from the rest of the address?
@
312
In what type of e-mail programs can the user copy an e-mail message by dragging the message to a storage medium such as a folder or drive?
GUI
313
What is the main information being sought when examining e-mail headers?
The originating e-mail's IP address
314
To retrieve e-mail headers in Microsoft Outlook what option should be clicked after the e-mail has been selected?
File, Properties
315
In Web-based e-mail how are messages displayed and saved?
Web pages in the browser's cache
316
In which discipline do professionals listen to voice recordings to determine who's speaking or read e-mail and other writings known to be by a certain person and determine whether that person wrote the e-mail or letter in question?
Forensic linguistics
317
To view Gmail Web e-mail headers, what should be clicked after the e-mail has been opened and the down arrow next to the Reply circular arrow has been clicked?
Show Original
318
To view e-mail headers on Yahoo!, what should be clicked on after 'More' has been selected?
View Raw Message
319
In Microsoft Outlook what file extension is used with saved, sent, drafted, deleted, and received e-mails?
.pst or .ost
320
Which site can be used to verify the names of domains a message is flowing through?
dkim.org
321
Which type of logging allocates space for a log file on the server and then starts overwriting from the beginning when logging reaches the end of the time frame or the specified log size?
Circular logging
322
Which files provide helpful information to an e-mail investigation?
Log files and configuration files
323
Which location contains configuration information for Sendmail?
/etc/mail/sendmail.cf
324
In which directory do UNIX installations typically store logs?
/var/log
325
In which log does Exchange log information about changes to its data?
Transaction log
326
In Exchange what type of file is inserted in the transaction log to mark the last point at which the database was written to disk in order to prevent loss of data?
Checkpoint file
327
In Microsoft Exchange which file is responsible for messages formatted with MAPI?
An .edb file
328
Which information from Facebook simply tells you the last time a person logged on the person's e-mail address and mobile number and whether the account can be viewed publicly?
Basic subscriber info
329
What format is used for the flat plaintext files some e-mail systems use for message storage?
mbox
330
Many people store more information on smartphones and tablets than on computers.
True
331
Investigating smartphones and other mobile devices is a relatively easy task in digital forensics.
False
332
TDMA can operate in the cell phone (800 to 1000 MHz) or PCS (1900 MHz) frequency.
True
333
Most basic phones use the same OSs as PCs.
False
334
Portability of information is what makes SIM cards so versatile.
True
335
In 2010 both VMware and BlackBerry were thinking of developing type 2 hypervisors for mobile devices.
True
336
Because bring your own device (BYOD) has become a business standard, investigators must consider how to keep employees' personal data separate from case evidence.
True
337
The IoA will eventually include 4G smart devices and 4G mobile networks.
False
338
Gaming consoles such as the Sony PlayStation and Xbox are safe because they don't contain information hackers might try to intercept and collect.
False
339
Research on wearable computers has been conducted at MIT labs for more than a decade and these computers are now moving into working reality.
True
340
What technology developed during WWII uses the full radio spectrum to define channels and is now used in the U.S. by Sprint, U.S. Cellular, and Verizon?
Code Division Multiple Access (CDMA)
341
Which type of digital network divides a radio frequency into time slots?
Time Division Multiple Access (TDMA)
342
Which type of network is a digital version of the original analog standard for cell phones?
Digital Advanced Mobile Phone Service (D-AMPS)
343
Which type of digital network is a faster version of GSM designed to deliver data?
Enhanced Data GSM Environment (EDGE)
344
Which standard introduced sleep mode to enhance battery life?
IS-136
345
Where do phones typically store system data?
Electronically erasable programmable read-only memory (EEPROM)
346
What type of cards consisting of a microprocessor and internal memory are usually found in GSM devices?
Subscriber identity module (SIM) cards
347
Which devices have been replaced by iPods, iPads, and other mobile devices for personal use?
Personal digital assistants (PDAs)
348
What structure is used for the file system for a SIM card?
Hierarchical structure
349
What does the SIM file structure begin with?
System root
350
Which tool provided by Paraben Software examines Internet of Things (IoT) devices, has a bootloader for locked mobile devices, and can perform data parsing and cloud data capture?
E3:DS
351
In a Windows environment what is the default storage location used by BitPim?
Documents\BitPim
352
Which forensics software tool contains a built-in write blocker?
MOBILedit Forensic
353
The Enhanced Data GSM Environment (EDGE) standard was developed specifically for which type of service?
3G
354
What entity created the Interim Standards used in mobile communications?
Telecommunications Industry Association (TIA)
355
What technique in which multiple phones take turns sharing a channel does the Global System for Mobile Communications (GSM) use?
Time Division Multiple Access (TDMA)
356
What entity developed the 3G standard?
International Telecommunication Union (ITU)
357
How much internal memory do mobile devices have?
Up to 64 GB
358
Which tool used by government agencies retrieves data from smartphones, GPS devices, tablets, music players, and drones?
Micro Systemation XRY
359
Which Cellebrite mobile forensics tool is often used by law enforcement and the military?
Cellebrite UFED Forensic System
360
The Internet is the successor to the Advanced Research Projects Agency Network (ARPANET).
True
361
A search warrant can be used in any kind of case either civil or criminal.
False
362
Specially trained system and network administrators are often a CSP's first responders.
True
363
The law requires search warrants to contain specific descriptions of what's to be seized. For cloud environments the property to be seized usually describes physical hardware rather than data unless the CSP is a suspect.
False
364
In the United States the Electronic Communications Privacy Act (ECPA) describes five mechanisms the government can use to get electronic information from a provider.
True
365
In 1999 Salesforce.com developed a customer relationship management (CRM) Web service that applied digital marketing research to business subscribers so that they could do their own market analysis; this service eventually led the way to the cloud.
True
366
The platform as a service cloud service is most likely found on a desktop or a server although it could also be found on a company network or the remote service provider's infrastructure.
True
367
Homomorphic encryption uses an 'ideal lattice' mathematical formula to encrypt data.
True
368
Remote acquisitions are often easier because you're usually dealing with large volumes of data.
False
369
Magnet AXIOM Cloud can retrieve information from Skype, Instagram, Twitter, and iCloud but not from Facebook Messenger.
False
370
Metadata in a prefetch file contains an application's ____ times in UTC format and a counter of how many times the application has run since the prefetch file was created.
MAC
371
Which organization has developed resource documentation for cloud service providers and their staff and provides guidance for privacy agreements, security measures, and other issues?
Cloud Security Alliance (CSA)
372
In which cloud service level are applications delivered via the Internet?
Software as a Service (SaaS)
373
What cloud application offers a variety of cloud services including automation and CRM, cloud application development, and Web site marketing?
Salesforce
374
What document issued by a judge compels the recipient to do or not do something?
Court order
375
What files created by Microsoft contain the DLL pathnames and metadata used by applications and reduce the time it takes to start applications?
Prefetch files
376
What is Microsoft's SkyDrive now called?
OneDrive
377
With cloud systems running in a virtual environment what can be used to give the investigator valuable information before, during, and after an incident?
Snapshots
378
Which type of order requires that the government offer specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication or the records or other information sought are relevant and material to an ongoing criminal investigation?
Court order
379
A government entity must show that there is probable cause to believe the contents of a wire communication an electronic communication or other records are relevant to an ongoing criminal investigation to obtain which type of order?
Search warrant
380
Which tool can be used to bypass a virtual machine's hypervisor and can be used with OpenStack?
Forensic Open-Stack Tools (FROST)
381
What cloud service provides a freeware type 1 hypervisor used for public and private clouds?
XenServer and XenCenter Windows Management Console
382
Which folder is most likely to contain Dropbox files for a specific user?
C:\Users\username\Dropbox
383
Which type of tool has application programming interfaces (APIs) that allow reconfiguring a cloud on the fly and is accessed through the application's Web interface?
Management plane
384
Which Dropbox file stores information on shared directories associated with a Dropbox user account and file transfers between Dropbox and the client's system?
filecache.dbx
385
At what offset are the application's last access date and time located in a prefetch file?
0x90
386
At what offset is a prefetch file's create date and time located?
0x80
387
Which cloud forensics training program is limited to law enforcement personnel?
National Institute of Justice Digital Forensics Training (NIJ DFT)
388
Where is the snapshot database created by Google Drive located in Windows?
C:\Users\username\AppData\Local\Google\Drive\user_default
389
Which Google Drive file contains a detailed list of a user's cloud transactions?
sync_log.log
390
Besides presenting facts reports can communicate expert opinion.
True
391
A verbal report is more structured than a written report.
False
392
If you must write a preliminary report use words such as 'preliminary copy', 'draft copy', or 'working draft'.
False
393
As with any research paper write the report abstract last.
True
394
When writing a report use a formal technical style.
False
395
When writing a report style means the tone of language you use to address the reader.
True
396
The decimal numbering system is frequently used when writing pleadings.
False
397
Lawyers use services called deposition banks (libraries) which store examples of expert witnesses' previous testimony.
True
398
Signposts assist readers in scanning the text quickly by highlighting the main points and logical development of information.
True
399
For civil cases including those involving digital forensics investigations U.S. district courts consider optional that expert witnesses submit written reports.
False
400
What is the standard format in U.S. federal courts for the electronic submission of documents?
Portable Document Format (PDF)
401
Which document serves as a guideline for knowing what questions an investigator should expect when testifying?
Examination plan
402
What is most appropriately used to help an attorney learn the terms and functions used in digital forensics?
Glossary of terms
403
A written report is often submitted as what type of document?
Portable Document Format (PDF)
404
What should be provided if a report is long and complex?
An abstract
405
Which document is sworn to under oath and penalty of perjury or a comparable false swearing statute?
Affidavit
406
What type of question should an attorney ask to allow an investigator to offer an opinion?
Hypothetical
407
Which Federal Rule of Evidence rule governs expert opinions?
Federal Rules of Civil Procedure (FRCP) 26; Federal Rules of Evidence (FRE) 702, 703, and 705
408
Anything an investigator writes down as part of examination for a report in a civil litigation case is subject to which action from the opposing attorney?
Discovery
409
Because opposing counsel can demand discovery on them what are written preliminary reports considered to be?
High-risk documents
410
How many words should an abstract contain?
150-200
411
Under FRCP Rule 26 where must the investigator's curriculum vitae be placed unless the bona fides are integrated elsewhere?
Appendices of the written report
412
In addition to decimal numbering what numbering system can be used in a written report?
Legal-sequential
413
Which numbering system is being used if the report writer divides material into sections and restarts numbering with each main section?
Decimal
414
What format is typically used to cite references in the main body of a report?
APA (last name, year of publication)
415
What section of a report should contain broader generalizations?
Conclusion
416
What section of a report should restate the objectives, aims, and key questions and summarize the findings with clear concise statements?
Conclusion
417
What section of a report can be used for material such as raw data figures not used in the body of the report and anticipated exhibits?
Appendices
418
In addition to text, word processing, and spreadsheet formats, which format is used for forensic reports and logs generated by forensic tools?
HTML
419
What sections of a report are included in the report body?
Introduction and discussion
420
As an expert witness you have opinions about what you have found or observed.
True
421
You should create a formal checklist of your procedures that's applied to all your cases or include such a checklist in your report.
False
422
As a standard practice, collect evidence and record the tools you used in designated file folders or evidence containers.
True
423
Like a job resume, your CV should be geared for a specific trial.
False
424
Part of what you have to deliver to the jury is a person they can trust to help them figure out something that's beyond their expertise.
True
425
The chain of custody of evidence supports the integrity of your evidence.
True
426
Depending on your attorney's needs you might give him or her just your opinion and technical expertise instead of testifying in court; this role is called an expert witness.
False
427
Motion in limine includes voir dire of venireman strikes and seating of jurors.
False
428
During opening statements both attorneys provide an overview of the case with the plaintiff's attorney going last.
False
429
Whether you're serving as an expert witness or a fact witness, be professional and polite when presenting yourself to any attorney or the court.
True
430
How many roles might a forensics examiner play in a trial?
Two
431
In which type of testimony does the investigator present evidence and explain what it is and how it was obtained?
Technical or scientific testimony
432
What should you use to verify evidence and thus ensure its integrity?
Hash algorithms
433
What should the forensics specialist keep updated and complete in order to support his or her role as an expert and document enhancement of skills through training teaching and experience?
Curriculum Vitae (CV)
434
How often should the document describing your expertise and used to qualify your testimony be updated to reflect new cases and additional training?
Every three months
435
Which motion provides a written list of objections to certain testimony or exhibits?
Motion in limine
436
What term refers to rejecting potential jurors?
Voir dire of venireman
437
What optional phase of a trial typically involves an issue raised during cross-examination of a witness?
rebuttal
438
How close should a microphone be to the person testifying?
6-8 inches
439
How many years of education does the typical juror have?
12
440
What method might be used by opposing attorneys to prevent an investigator from serving on an important case?
Conflicting out
441
What term refers to evidence that exonerates or diminishes the defendant's liability?
Exculpatory evidence
442
What type of testimony occurs when the investigator answers questions from the attorney who hired the investigator?
Direct testimony
443
What is the most important part of an investigator's testimony at a trial?
Direct examination
444
Generally the best approach an attorney can take in direct examination is to ask the investigator what type of questions?
Open-ended
445
Leading questions such as 'Isn't it true that forensics experts always destroy their handwritten notes', are referred to as what type of questions?
Setup questions
446
What type of questions ask several questions inside one question?
Compound questions
447
How is a deposition different from trial testimony?
There is no jury or judge present
448
Which type of deposition is used to give an opposing attorney the chance to conduct what amounts to a direct examination and cross-examination of a witness?
Discovery deposition
449
Which practice is advisable when an investigator gives a deposition?
Stay relaxed and confident, maintain a professional demeanor, use facts, take your time, answer only the questions you are asked
450
People need ethics to help maintain their balance especially in difficult and contentious situations.
True
451
In the United States there's no state or national licensing body for digital forensics examiners.
True
452
Experts should be paid in full for all previous work and for the anticipated time required for testimony.
True
453
Expert opinions cannot be presented without stating the underlying factual basis.
False
454
The American Bar Association (ABA) is a licensing body.
False
455
When searching for specific record information sometimes you see duplicate files with the same name that have different data runs meaning the file was written to disk more than once on separate occasions.
True
456
As an expert witness you can't testify if you weren't present when the event occurred.
False
457
When you're aware of a possible disqualification issue bring it to the attention of the opposing attorney.
False
458
No single source offers a definitive code of ethics for expert witnesses so you must draw on standards from other organizations to form your own ethical standards.
True
459
There are inherent conflicts between the goals of attorneys and the goals of scientists or technicians (experts).
True
460
What are the most important laws applying to attorneys and witnesses?
Rules of evidence
461
Forensic examiners may serve as what types of witnesses?
Fact and expert
462
What resource might attorneys use to search for information on expert witnesses?
Deposition banks
463
What type of questions can give the investigator the factual structure to support and defend his or her opinion?
Hypothetical
464
Which Federal Rule of Evidence is used to determine whether the expert is qualified and whether the expert opinion can be helpful?
FRE 702
465
Which Federal Rule of Evidence is used to determine whether the basis for testimony is adequate?
FRE 703
466
Which organization has stated that, unlike attorneys, expert witnesses do not owe a duty of loyalty to their clients?
American Bar Association (ABA)
467
Which document offers comprehensive guidance for psychologists with an entire section devoted to forensics activities?
American Psychological Association's (APA's) Ethics Code
468
Which standard states that to provide reliable and valid testimony the expert has the 'ethical responsibility to present a complete and unbiased picture of the . . . research relevant to the case at hand'?
Daubert
469
Attorneys who contact many experts as a ploy to disqualify them or prevent opposing counsel from hiring them are using what practice?
Conflicting out
470
Which outcome when caused by an ethical lapse could effectively be a death sentence for a career as an expert witness?
Disqualification
471
How can an investigator minimize any challenges an opposing attorney could make to discredit the investigator's report or testimony?
Being as thorough as possible
472
In what court case did the court summarize the process of determining whether an expert should be disqualified because of previous contact with an opposing party?
Wang Laboratories, Inc. v. Toshiba Corp.
473
Suppose you have been hired to determine whether a corrupted file was intentionally altered or altered by a virus. Your forensic examination did not find evidence of a virus and did not find evidence of intentional alteration. What conclusion can you offer?
The cause of the corruption is unknown
474
Which action isn't usually punitive but can be embarrassing for the professional and potentially for the attorney who retained the professional?
Disqualification
475
Which term refers to internalized rules used to measure one's own performance?
Ethics
476
Requesting which of these will deter attorneys from communicating with an investigator solely for the purpose of disqualifying that investigator?
Retainer
477
Which of the following options would represent a valid retainer?
2-8 hours of your usual billable rate
478
What is reduced by knowing who the parties in a case are?
Possibility of a conflict
479
What can a consultant who doesn't testify earn for finding testifying experts or investigative leads?
Contingency fee
