Forensics

Question 1

Evidence collection must be priorized by

Answer 1

volatility

Question 2

First responders should first _____ and then _____.

Answer 2

assess and contain

Question 3

To image a live system, ____ ____ images must be created

Answer 3

bit-level

Question 4

Bit-level images must be created in _____

Answer 4

copies

Question 5

Bit-level images must have ______

Answer 5

checksums

Question 6

When creating a bit-level image of a static system, a _____ _____ must be used when connecting to a forensic workstation.

Answer 6

write-blocker

Question 7

Documents that need to be created for forensics

Answer 7

Tracking log, chain of custody

Question 8

In containment, systems may need to be….

Answer 8

Plugged out of the network, but not turned off ideally

Question 9

Mitigations comes after ______

Answer 9

containment

Question 10

classification is also called

Answer 10

data labeling

Question 11

Modes of data acquisition for mobile devices

Answer 11

Physical (sim, memory cards and backups)
Logical: forensic image of storage volumes
Manual Access: Reviewing contents manually on live phone
Filesystem: deleted files and metadata