Midterm Flashcards
what is the first consideration when responding to a scene?
Safety
is ram volatile or non volatile?
volatile
Can information in the bios change?
Yes
Is information stored lost in a proper shutdown ROM
no
The smallest area on a drive that data can be written to is a _____ while on a file can be written to is a ________
sectors and clusters
aquring a image in encase will compress the image md5?
F
What is an md5
hash algorithm/validation verification of entire file
What is a crc
redundancy check ensuring data was not altered
space at the end of the logical file and the physical file end of a data is
slackspace
how do you know an evidence file contains the exact copy of the evidence?
acquisition sha1 and verification sha1
what is a field header and footer for a file jpg in hex?
ffd and ffd9
warning banner contains?
statements about both privacy and law
two concerns for aquring a Raid server?
time for a full scan would take, knowing the version of raid
what term refers to shield emr emissions
tempest labs
last creation date
last creation date is two of them one when the camera takes the image and when it’s transfered to computer
plain view doctrine is a well established(T/F)
F
computer prefilled or attachment can contain dna evidence? (T/F)
T
what does NTUSER.dat contain?
personal user configs specific to each user
CxHxS
cluster, heads, sectors
in testing terms reproducible results if you work on the same machine produce the same results(T/F)
false different between repeated results versus reproducible is on a different machine
blackberry curve tdurden
10- item path
what is bios what are two things as analysis will look for in setting?
system date and time, boot order
list two situation when it would be acceptable to navigate through a live system?
a retail system, macbook or anything password protected because once it’s shut down that’s it, safety issues
usbs are
mounted devices
