Midterm

Question 1

what is the first consideration when responding to a scene?

Answer 1

Safety

Question 2

is ram volatile or non volatile?

Answer 2

volatile

Question 3

Can information in the bios change?

Answer 3

Yes

Question 4

Is information stored lost in a proper shutdown ROM

Answer 4

no

Question 5

The smallest area on a drive that data can be written to is a _____ while on a file can be written to is a ________

Answer 5

sectors and clusters

Question 6

aquring a image in encase will compress the image md5?

Answer 6

F

Question 7

What is an md5

Answer 7

hash algorithm/validation verification of entire file

Question 8

What is a crc

Answer 8

redundancy check ensuring data was not altered

Question 9

space at the end of the logical file and the physical file end of a data is

Answer 9

slackspace

Question 10

how do you know an evidence file contains the exact copy of the evidence?

Answer 10

acquisition sha1 and verification sha1

Question 11

what is a field header and footer for a file jpg in hex?

Answer 11

ffd and ffd9

Question 12

warning banner contains?

Answer 12

statements about both privacy and law

Question 13

two concerns for aquring a Raid server?

Answer 13

time for a full scan would take, knowing the version of raid

Question 14

what term refers to shield emr emissions

Answer 14

tempest labs

Question 15

last creation date

Answer 15

last creation date is two of them one when the camera takes the image and when it’s transfered to computer

Question 16

plain view doctrine is a well established(T/F)

Answer 16

F

Question 17

computer prefilled or attachment can contain dna evidence? (T/F)

Answer 17

T

Question 18

what does NTUSER.dat contain?

Answer 18

personal user configs specific to each user

Question 19

CxHxS

Answer 19

cluster, heads, sectors

Question 20

in testing terms reproducible results if you work on the same machine produce the same results(T/F)

Answer 20

false different between repeated results versus reproducible is on a different machine

Question 21

blackberry curve tdurden

Answer 21

10- item path

Question 22

what is bios what are two things as analysis will look for in setting?

Answer 22

system date and time, boot order

Question 23

list two situation when it would be acceptable to navigate through a live system?

Answer 23

a retail system, macbook or anything password protected because once it’s shut down that’s it, safety issues

Question 24

usbs are

Answer 24

mounted devices

Question 25

how much is in a sector

Answer 25

512

Question 26

what HPA can FTKimager image HPA

Answer 26

HOST protected area FTK cannot