Mid Term Flashcards
True or False
Digital forensics and data recovery refer to the same activities
False
Police in the united states must use the procedures that adhere to which of the following?
4th Amendment
List two types of digital investigations typically conducted in a business environment.
Fraud
Espionage
Why should evidence media be write-protected?
You don’t the original data to be altered or corrupted.
Data collected before an attorney issues a memo for an attorney-client privilege case is a protected under the confidential work product rule.
False - they need to have a warrant
An employer can be held liable for email harassment.
True
The manager of a digital forensics lab is responsible for which of the following?
Understand what the digital forensics lab is responsible for.
Insuring enough staff training for the employers so they know they’re doing the job.
Know the objective of the designated task.
To maintain the chain of custody and prevent data from being lost, corrupted, or stolen is the reason why physical security is so critical for digital forensics labs.
True
A forensics workstation should always have a direct broadband connection to the internet.
False
What name refers to labs constructed to shield EMR emissions?
Tempest
Name the three formats for digital forensics data acquisitions.
Raw Format
Proprietary Formats
Advance Forensic Format
What does a logical acquisition collect for an investigation?
Only specific files to interest to the case.
Why is it good practice to make two images of a suspect drive in a critical investigation.
To ensure at least one good copy of the forensically collected data in case of any failures.
What is a hashing algorithm?
A program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk.
In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a corporate investigator can conduct covert surveillance on an employee with little cause.
True
As a corporate investigator, you can become an agent of law enforcement when which of the following happens?
You begin to take orders from a police detective without a warrant or subpoena.
Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement
What are the three rules for a forensic hash?
t can’t be predicted
No two files can have the same hash value
If the file changes, the hash value changes.
Which of the following techniques might be used in covert surveillance?
Keylogging
Data sniffing refer to review sheets.
List two hashing algorithms commonly used for forensics purposes.
MD5 and SHA-1
What does MFT stand for?
Master File Table
Device drivers contain what kind of information?
Instructing the hardware on how to operate on that particular operating system.
An image of a suspect drive can be loaded on a virtual machine?
True
What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder?
It will not be encrypted.
Forensic software tools are grouped into _____ and _____ applications
command line
GUI
Hash values are used for which of the following purposes?
Filtering
Validating
The verification function does which of the following?
Proves that two sets of data are identical via hash values
The log report in forensics tools does which of the following?
Records an investigator’s actions in examining a case
Capitalization, or lack thereof, makes no difference with UNIX and Linux commands
False - Linux is case sensitive.
What file under the /etc folder contains the hashed passwords for a local system?
Shadow
_____ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.
Inodes
Where is the root user’s home directory located on a MAC OS X file system?
/private/var/root
_____ is a specialized carving tool that can read many image file formats, such as RAW and Expert Witness.
Foremost
How many bits are required to create a pixel capable of displaying 65,536 different colors.?
16
What kind of graphics file combines bitmap and vector graphics types?
GIF, JPG, PNG
The process of converting raw picture data to another format is called _____.
Demosaicing
Referred to as a digital negative, the _____ is typically used on many higher end digital cameras.
raw file format
