Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Technology > ITN276 - Computer Forensics - Midterm Exam - Review > Flashcards

ITN276 - Computer Forensics - Midterm Exam - Review Flashcards

Study Guide Definitions

1
Q

Computer Forensics

A

The American Heritage Dictionary defines __________as “the use of science and technology to investigate and establish facts in criminal or civil courts of law.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Roles of the first responder to a crime scene

A

Prepare evidence

Preserve Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Chain of Custody

A

The continuity of control of evidence that makes it possible to account for all that has happened to evidence between its original collection and its appearance in court, preferably unaltered.

One must be able to show the whereabouts and custody of the evidence, how it was handled and stored and by whom, from the time the evidence is first seized by a law enforcement officer or civilian investigator until the moment it is shown in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Daubert standard

A

TheDaubert Standard dictates that only methods and tools widely accepted in the scientific community can be used in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Anti-forensics

A

The actions that perpetrators take to conceal their locations, activities, or identities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Rainbow table

A

Rainbow table means type of password crackers that work with pre-calculated hashes of all passwords available within a certain character space.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Physical analysis

A

offline analysis conducted on an evidence disk or forensic duplicate after booting from a CD or another system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Bit-level information

A

information at the level of actual 1s and 0s stored in memory or on the storage device, as opposed to going through the file system’s interpretation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Volatile Data

A

Data that changes rapidly and may be lost when the machine that holds it is powered down?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Temporary Data

A

Data that an operating system creates and overwrites without the computer user taking a direct action to save this data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Types of cyber crime

A

Identity theft

Hacking Systems for data .

Cyberstalking / Harassment

Internet Fraud -

Non Access Computer Crimes

Cyber Terrorism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Techniques that cybercriminals use

A

Phishing - attempt to trick a victim into giving up personal information

Spyware - any software that can monitor your activity on a computer

Hacking - breaking into a system

SQL Injection - May be the most common Web application attacj and is based on inserting Structured Language Query (SQL) commands into text boxes such as the username and password fields on a login screen.

XSS (Cross Site Scripting) - perp seeks out somewhere that allows end users to post and posts javascript that will execute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Sarbanes-Oxley Act of 2002

A

contains many provisions about recordkeeping and destruction of electronic records relating to the management and operation of publicly held companies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SQL attack

A

May be the most common Web application attack and is based on inserting Structured Language Query (SQL) commands into text boxes such as the username and password fields on a login screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ophcrack

A

One of the most basic tools or physically accessing a Windows machine.

Tool to crack Windows passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A ________ is malware that is designed to do harm to the system when some logical condition is reached.

A

logic bomb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Virus

A

any software that self-replicates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A customized Linux Live CD used for computer forensics.

A

Helix

19
Q

Denial of Service (DoS)

A

attack is designed to render the target unreachable by legitimate users, not to provide the attacker access to the site.

20
Q

Basis Technology invented an open file standard format with three variations, all supported by Sleuth Kit and Autopsy. The name of this file format is what?

A

the Advanced Forensic Format

21
Q

Slack space

A

The unused space between the logical end of file and the physical end of file is known as (aka. file slack)

22
Q

Unallocated space

A

Also known as free space - area of the hard drive that has never been allocated for file storage of leftover area that the computer regards as unallocated after file deletion.

A computer cant access any unallocated space in a partition.

23
Q

Raw format

A

The RAW Image Format is basically a bit-for-bit copy of the RAW data of either the disk or the volume, without any additions or deletions. There is no metadata stored in RAW Image Format files. … The RAW Image Format was originally used by dd, but is supported by most of the computer forensics applications

24
Q

Disk imaging

A

Imaging create a large compressed file of your drive. You can then restore this file to bring your drive back to life. Because the image file itself is large, people often save them to external drives or file shares.

25
Q

Tools for forensic imaging

A

s

26
Q

People try to thwart investigators by using encryption to scramble information or_________ to hide information, or both together.

A

antiforensics, steganography, running processes

27
Q

Data acquisition methods

A

Static and live

28
Q

Static and live data acquisition

A

LIVE - a data acquisition method used when a suspect computer can’t be shut down to perform a static acquisition. data is collected from the local computer or over a remote network connection. the captured data might be altered during the acquisition because it’s not write-protected. live acquisitions aren’t repeatable because data is continually being altered by the suspect computer’s OS.

STATIC - a data acquisition method used when a suspect drive is write-protected and can’t be altered. if disk evidence is preserved correctly, static acquisitions are repeatable

29
Q

Net sessions command

A

Shows even meaningless connections such as the comuter opening a web browser.

Shows only established network communication sessions.

30
Q

MD5

A

The MD5 hash function was originally designed for use as a secure cryptographic hash algorithm for authenticating digital signatures

31
Q

dd and dcfldd commands

A

Used to make copies of a suspect drive.

32
Q

WinAudit

A

WinAudit is an inventory utility for Windows computers. It creates a comprehensive report on a machine’s configuration, hardware and software. WinAudit is free, open source and can be used or distributed by anyone.

33
Q

Swap file

A

The most important type of ambient data that Windows uses to write data when additional RAM is needed.

A virtual extension of RAM

34
Q

Net sessions command

A

Shows even meaningless connections such as the computer opening a web browser.

Shows only established network communication sessions.

35
Q

Volume slack

A

The space that remains on the hard drive if the partitions do not use all the available space.

36
Q

Steganalysis

A

The process of analyzing a file or files for hidden content.

A Difficult task and at best shows a likelihood that a given file has additional information hidden in it.

37
Q

Steganography

A

The art and science of writing hidden messages. The goal is to hide information so that even if it is intercepted, it is not clear what information is hidden there

38
Q

Metadata

A

Data about information (data about data) such as disk partition structures and file tables. Also includes file creation and modification times.

39
Q

Gigabyte

A

1000 bytes

40
Q

Search warrant

A

Needed to search computer

41
Q

Plain view

A

No warrant needed if in plain sight

42
Q

Sarbanes-Oxley Act of 2002

A

Contains many provisions about recordkeeping and destruction of electronic records relating to the management and operation of publicly held companies.

43
Q

Netstat

A

netstat (network statistics) is a command-line network utility that displays network connections for Transmission Control Protocol (both incoming and outgoing), routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol …

Technology (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions