Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SOC Analyst HackTheBox Academy Path > Introduction to Digital Forensics > Flashcards

Introduction to Digital Forensics Flashcards

1
Q

What is Digital Forensics?

A

A specialized branch of cybersecurity that involves the collection, preservation, analysis, & presentation of digital evidence to investigate cyber incidents, criminal activities, and security breaches. It applies forensic techniques to digital artifacts to uncover the truth behind cyber-related events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the aim of digital forensics?

A

To reconstruct timelines, identify malicious activities, assess the impact of incidents, and provide evidence for legal or regulatory proceedings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where is electronic evidence collected from and what is collected?

A

Electronic evidence is collected from computers, mobile devices, servers, cloud services, and other digital sources. And the evidence can include files, emails, logs, databases, network traffic, and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Preservation of Evidence

A

Ensuring the integrity and authenticity of digital evidence is crucial.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Stages in the Forensic Process

A
  • Identification
  • Collection
  • Examination
  • Analysis
  • Presentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Forensic Process: Identification

A

Determining potential sources of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Forensic Process: Collection

A

Gathering data using forensically sound methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Forensic Process: Examination

A

Analyzing the collected data for relevant information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Forensic Process: Analysis

A

Interpreting the data to draw conclusions about the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Forensic Process: Presentation

A

Presenting findings in a clear and comprehensible manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Types of Cases

A
  • Cybercrime investigations (hacking, fraud, data theft)
  • Intellectual property theft
  • Employee misconduct investigations
  • Data breaches and incidents affecting organizations
  • Litigation support in legal proceedings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Basic steps for performing a forensic investigation

A
  1. Create a Forensic Image
  2. Document the System’s State
  3. Identify and Preserve Evidence
  4. Analyze the Evidence
  5. Timeline Analysis
  6. Identify Indicators of Compromise (IOCs)
  7. Report and Documentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

New Technology File System (NTFS)

A

A proprietary file system developed by Microsoft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Predecessor of NTFS

A

File Allocation Table (FAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What File Metada is stored in NTFS

A

Creation time, modification time, & attribute information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Master File Table (MFT)

A

A crucial component of NTFS that stores metadata for all files and directories on a volume. When files are deleted, their MFT entries are marked as available, but the data may remain on the disk untiil overwritten.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What do MFT Entries provide during examination?

A

Insights into file names, sizes, timestamps, and data storage locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Unallocated Space on an NTFS volume

A

May contain remnants of deleted files or fragments of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

File slack

A

The unused portion of a cluster that may contain data from a previous file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

File Signatures

A

Useful, along with file headers, in identifying file types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Update Sequence Number (USN) Journal

A

A log maintained by NTFS to record changes made to files and directories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

LNK Files

A

Windows shortcut files (LNK files) contain information about the target file or program, as well as timestamps and metdata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Prefetch Files

A

Generated by Windows to improve the startup performance of applications. Can indicate which programs have been run on the system & when they were last executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Registry Hives

A

Contain important configuration and system information. Malicious activities or unauthorized changes can leave traces in the registry. Not directly related to the file system

25
Q

Shellbags

A

Registry entries that store folder view settings. Can reveal user navigation patterns and potentially identify accessed folders

26
Q

Thumbnail Cache

A

Store miniature previews of images & documents. Can reveal files that were recently viewed, even if the original files have been deleted

27
Q

Recycle Bin

A

Contains files that have been deleted from the file system

28
Q

Alternate Data Streams (ADS)

A

Additional streams of data associated with files. Malicious actors may use ADS to hide data

29
Q

Volume Shadow Copies

A

Snapshots of the file system at different points in time. Supported by NTFS

30
Q

Secruity Descriptors and Access Control Lists (ACLs)

A

Determine file & folder permissions. Analyzing artifacts helps understand user access rights and potential security breaches

31
Q

Default File Path for Log Storage

A

C:\Windows\System32\winevt\logs

32
Q

Windows execution artifacts

A

Traces & evidence left behind on a Windows OS when programs & processes are executed.

33
Q

Windows Execution Artifact: Prefetch Files

A

Windows maintains prefetch folder that contains metadat about the execution of various applications. Prefetch files can reveal a history of executed programs & the order in which they were run

C:\Windows\Prefetch

34
Q

Windows Execution Artifact: Shimcache

A

Windows mechanism that logs information about program execution to assist with compatibility and performance optimizations. Can help identify recently executed programs & their associated files.

Registry:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

35
Q

Windows Execution Artifact: Amcache

A

A database introduced in Windows 8 that stores info about installed applications and executables. Can provide insights into program execution history & identify potentially suspicious or unauthorized software

C:\Windows\AppCompat\Programs\Amcache.hve (Binary Registry Hive)

36
Q

Windows Execution Artifact: UserAssist

A

A registry key that maintains info about programs executed by users

Registry:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurentVersion\Explorer\UserAssist

37
Q

Windows Execution Artifact: RunMRU Lists

A

RunMRU (Most Recently Used) lists in Windows Registry store info about recently executed programs from various locations. Can indicate which programs were run, when they were executed, & potentially reveal user activity

Registry:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

38
Q

Windows Execution Artifact: Jump Lists

A

Store info about recently accessed files, folders, & tasks associated with specific applications.

User-specific folders (e.g., %AppData%\Microsoft\Windows\Recent)

39
Q

Windows Execution Artifact: Shortcut (LNK) Files

A

Can contain info about the target executable, file paths, timestamps, & user interactions

Various locations (e.g., Desktop, Start Menu)

40
Q

Windows Execution Artifact: Recent Items

A

Folder that maintains a list of recently opened files

User-specific folders (e.g., %AppData%\Microsoft\Windows\Recent)

41
Q

Windows Execution Artifact: Windows Event Logs

A

Record events related to program execution, application crashes, & more

C:\Windows\System32\winevt\Logs

42
Q

Windows Persistence

A

The techniques & mechanisms used by attackers to ensure their unauthorized presence & control over a compromised system, allowing them to maintain access & control even after initial intrusion

43
Q

Windows Registry

A

Acts as a crucial database, storing critical system settings for the Windows OS

44
Q

What are some Autorun keys used for persistence?

A
  • Run/RunOnce Keys
  • Keys used by WinLogon Process
  • Startup Keys
45
Q

Scheduled Tasks (Schtasks)

A
  • saved as XML file, details creator, task’s timing/trigger, & path to command/program set to run
  • C:\Windows\System32\Tasks
46
Q

Services in Windows

A

Pivotal for maintaining processes on a system, enabling software components to operate in background w/o user intervention

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

47
Q

Web Browser: Cookies

A

Small data files stored by websites on a user’s device, containing info such as session details, preferences, & authentication tokens

48
Q

Web Browser: Cache

A

Cached copies of web pages, images, & other content visited by the user. Can reveal websites even if the history is cleared

49
Q

Web Browser: Session Data

A

Info about active browsing sessions, tabs, & windows

50
Q

Web Browser: Typed URLs

A

URLs entered directly into the address bar

51
Q

Web Browser: Favicons

A

Small icons associated w/ websites, which can reveal visited sites

52
Q

System Resource Usage Monitor (SRUM)

A

Meticulously tracks resource utilization and application usage patterns. Data is housed in database file sru.db in C:\Windows\System32\sru. Can help reconstruct application & resource usage over specific durations

53
Q

SRUM: Application Profiling

A

Provides comprehensive view of applications & processes that have been executed on a Windows system. Crucial for understanding software landscape on a system, identifying potentially malicious or unauthorized applications, & reconstructing user activities

54
Q

SRUM: Resource Consumption

A

Captures data on CPU time, network usage, & memory consumption for each application & process.

55
Q

SRUM: Timeline Reconstruction

A

Can create timelines of application & process execution, resource usage, & system activities by analyzing SRUM data

56
Q

SRUM: User & System Context

A

Includes user identifiers, helps attribute activities to specific users

57
Q

SRUM: Malware Analysis & Detection

A

Used to identify unusual or unauthorized applications taht may be indicative of malware or malicious activities

58
Q
A

SOC Analyst HackTheBox Academy Path (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions