Final Exam fall 2019 Flashcards
Discuss the similarities and the differences between Digital Forensics and Digital Security
Similarites:
Work with risk assessments.
Work with policies
but different aims and functions.
Security wants to keep malware of the computer by upholding policies and like.
Security wants to sanitize the computer from all malware and other malicious files.
Forensics investigates how the computer came to be infected and if any policies were violated.
Forensics wants to preserve the system.
Discuss the similarities and the differences between Digital Forensics and Auditing
Both want to extract hidden data an analyze it.
Both imply methodical and systematic examination or processes.
Both are reactive.
Both should be done externally to ensure impartiality and independence.
Auditing can be scheduled as a recurring process.
???????
Please enumerate the three main computer crime categories and explain their characteristics.
Computer as a target; system locked by ransomware, stolen company information
Computer as data repositories; storing illegal material
Computer as a tool; Sending virus, hacking, deleting files.
Discuss the concept of Quality Assurance in the context of digital evidence and digital forensic examination.
Digital Evidence and Digital Forensics should produce high quality results that are; Reliable, Accurate, Reproducible and legally acceptable. Therefore it is necessary that the investigation and documentation is according to the QA Documentation set and upheld by the QA Manager
QA Manager makes sure all these policies and other do
Explain briefly the Locard’s principle.
How might Locard’s principle affect a digital event scene?
Contact between two items will result in an exchange of data and/or physical evidence.
Offender - evidence transf. - Crime Scene - evidence transf. - Victim
Why is Daubert standard so important with respect to Digital Evidence?
Daubert standard defines the principles that makes the expert witness testimony admissible in the court of law.
( Judge as a gatekeeper, Reliable, Relevant, Scientific knowledge )
This is easy to apply in any situation and sets the standard for expert witness and the evidence presented. The Daubert standard is intensively tested, commonly agreed on and has known potential error rates.
What makes the transportation of digital evidence such a critical factor in a digital forensic investigation?
It is always important to protect the chain of custody
Transportation makes it extra important to ensure that the transported evidence is the same as the original data and that nothing has been altered.
The transportation and packaging should be done with care to make sure that the evidence is protected from the environment and theft.
Contras live vs frozen system processing with respect to digital forensic examination.
Pros and Cons?
Live evidence:
Pros;
Possibility to find the live connections to other evidence and/or suspects.
Possibility of the system being unlocked/decrypted
Access to RAM
Possibility to find encryption keys in the memory
Cons; Limited time Might tip off or interfere with the attacker Restricted by the order of volatility. Risk of ruining evidence. Transient process
Frozen evidence:
Pros;
More time
Less risk of accidentally contamination/destroying evidence
Cons;
Evidence can have been altered/hidden or destroyed by the offender before the system was frozen
No access to RAM
What does the property of preimage resistance mean in a context of a hashing function?
Preimage resistance = Shouldn’t be able to recreate a document with the hash value
Second Preimage Resistance = Shouldn’t be possible to create a new document with the same hash sum.
What does it mean to forensically “wipe clean” an acquisition drive?
Explain the ramifications of a forensically clean drive
To “wipe clean” an acquisition drive means that you “remove” all data from a drive to make it impossible to recover the data.
Ramification:
Being unable to recover any data from the drive.
Can’t find files from old case by mistake.
Chain of Custody
?????
State the digital evidence extraction/acquisition hierarchy.
The higher up the harder to do, less commonly used.
Micro-read Chip-off Physical Logical Manual
What is meant by the principle “Order of Volatility”?
Why is it important to apply this principal to a digital forensic acquisition?
You should collect your evidence in order of volatility; from the most volatile to the least volatile.
Registers, cash Routing table, ARP cache, process table memory Disk Remote logging and monitoring data Physical configuration, Network topology Archival media
In the context of the Windows $MFT, please answer the following question:
What type of information can be retrieved from Standard Information attribute (SIA)?
A resident attribute identifier
Contains information about date and timestamps displayed by Windows and most forensics tools.
FYLL PÅ
In the context of the Windows $MFT, please answer the following question:
What type of information can be retrieved from File Name Attribute (FNA)?
A resident attribute identifier
Reference to parent folder (by MFT Record Number)
File Names (Unicode)
File’s physical and logical size
Usually not updated through system usage
Useful for investigating date-time tampering
As an investigator you have found a Link File on Windows system. This link file point to a missing file.
What could be the significance of this link file in your investigation?
Explain what information can be retrieved from it?
Link Files contain important user knowledge such as timestamps, volume label, UID an path to target.
It could provide knowledge about the existence of another disk. Might indicate knowledge, existence or usage of the linked file
Why in the Windows operation system is there a difference between Logical file size and Physical file size?
What is the reason behind the appearance of the difference?
Logical size = Actual size of the file
Physical size = Represents the space the file allocates on the disk
When a file is saved the data is stored in clusters. If the cluster size is 512 bytes and a files Logical size is 678 bytes it will require two clusters to fit the 678 bytes, rendering the files Physical size to 1024 bytes. The unused space is called file slack
What type of information can be redrived from Standard Information Attribute (SIA)?
Resident attribute identifiers
Information about date and timestamps displayed by windows and most forensic tools.
What type of information can be retrieved from File Name Attribute (FNA)?
Reference to parent folder (by MFT Record Number)
File name (Unicode)
Files Physical and Logical Size
Usually not updated through system usage and is useful for investigating date-time tempering.
Explain the concept of the “prefetch” folder in a Windows operation system and how it can be used to infer user activity.
Prefetch is a Windows program that speeds up programs and files by pre loading the ones that are used regularly by the user in order to be able to start them faster. In the Prefetch folder you see the last run time and run count.
If a file/program is shown in the prefetch folder it may prove that the program file has been opened by the user.
Differentiate between File Metadata and File System Metadata
File System Metadata contains informations such as timestamps, permissions, status of a file, resident or non resident and file path. (Data från att man hanterar filerna) (Attributes about the data in a spcific file)
File Metadata is created when the file is created and changed. GPS coordinates from a picture, camera model.
What does the “MAC times” stand for and what each for the properties represents. Explain how and when the violation of MAC times metadata can happen.
mtime - Modification - When were the file last modified?
atime - Access - When did the file last get opened?
ctime - Creation/Change - When did the file get created? (win) / When did the metadata last change? (unix)
