Miscellaneous

Question 1

Where is the file signature located for a digital file?

Answer 1

the first 20 bytes of the file

Question 2

In File Carving, file identification and extraction is based on certain characteristics such as ______ ______ ______ ______ rather than the file extension or metadata.

Answer 2

file header or footer

In this technique, file identification and extraction is based on certain characteristics such as file header or footer rather than the file extension or metadata.

Question 3

A file header as a signature is also known as?

Answer 3

a magic number

Question 4

File carving refers to a technique that is used to recover deleted/lost files and fragments of files from the hard disk when?

Answer 4

file system metadata is missing

Question 5

File carving in SSDs is different from HDDs because?

Answer 5

files deleted from the TRIM (enabled by default) enabled SSDs cannot be recovered

Question 6

In TRIM _______ SSD’s, the forensic investigator can perform file carving to recover lost data from the drive.

Answer 6

disabled

In TRIM disabled SSD’s, the forensic investigator can perform file carving to recover lost data from the drive.

Question 7

When a file is deleted from Linux using the command ______, the _____ pointing to the file gets removed but the file remains on the disk until it is ______ with new data

Answer 7

/bin/rm/
inode
overwritten

When a file is deleted from Linux using the command /bin/rm/, the inode pointing to the file gets removed but the file remains on the disk until it is overwritten with new data

Question 8

In Linux, if an executable erases itself, its contents can be retrieved from a ______ memory image.

Answer 8

/proc

In Linu, if an executable erases itself, its contents can be retrieved from a /proc memory image.

Question 9

What does the HTTP GET method do?

Answer 9

GET is used to request data from a specified resource.

Question 10

What does the HTTP POST method do?

Answer 10

POST is used to send data to a server to create/update a resource.

Question 11

What does the HTTP Connect method do?

Answer 11

The CONNECT method is used to start a two-way communications (a tunnel) with the requested resource.

Question 12

What is a CFL?

Answer 12

Computer Forensics Lab

Question 13

What are the 2 main accreditations for forensic lab licensing?

Answer 13

ASCLD/LAB Accreditation
ISO/IEC 17025

Question 14

What does ASCLD/LAB stand for?

Answer 14

The American Society of Crime Laboratory Directors/Laboratory Accreditation Board

Question 15

What does ASCLD/LAB do?

Answer 15

They assess and certify the competence of forensic laboratories

Question 16

What does ASCLD/LAB accreditation enhances for a digital forensics lab?

Answer 16

ASCLD/LAB accreditation enhances the credibility of a digital forensics lab, making its findings more likely to be accepted in court.

Question 17

ASCLD/LAB accreditation ensures that the lab follows standardized procedures, which is crucial for what?

Answer 17

The reliability and repeatability of forensic investigations.

Question 18

What is the ISO/IEC 17025 standard?

Answer 18

ISO/IEC 17025 is an international standard that specifies the general requirements for the competence of testing and calibration laboratories. This standard is used by laboratories to develop their quality management systems and ensure they can consistently produce valid results.

Question 19

Who launched the Computer Forensics Tool Testing Project (CFTT)?

Answer 19

National Institute of Standards and Technology (NIST)

Question 20

What are the two main types of search warrants for a digital forensics investigation?

Answer 20

Electronic Storage Device Search Warrant, Search Provider Search Warrant

Question 21

What is the equivalent in LInux of the dir command in Windows?

Answer 21

ls

Question 22

Where are the recently created files located in Windows and a place to look for malware?

Answer 22

startup or system32 folder

Question 23

Where are recently created documents in Linux and a place to look for malware?

Answer 23

rc.local file

Question 24

What does ACPO mean?

Answer 24

Association of Chief Police Officers

Question 25

Which ACPO principles do they refer to (Principle 1 - Principle 4)? A. An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. B. No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. C. The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to. D. In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court

Answer 25

A. Principle 3 B. Principle 1 C. Principle 4 D. Principle 2

Question 26

What does SWGDE stand for?

Answer 26

Scientific Working Group on Digital Evidence

Question 27

What does SWGDE stand for?

Answer 27

Scientific Working Group on Digital Evidence

Question 28

Which SWGDE principles do these refer to? (Principle 1 Standards and Criteria 1.1 Standards and Criteria 1.2 Standards and Criteria 1.3 Standards and Criteria 1.4 Standards and Criteria 1.5 Standards and Criteria 1.6 Standards and Criteria 1.7) A. Procedures used must be generally accepted in the field or supported by data gathered and recorded in a scientific manner. B. All agencies that seize and/or examine digital evidence must maintain an appropriate SOP document. All elements of an agency's policies and procedures concerning digital evidence must be clearly set forth in this SOP document, which must be issued under the agency's management authority. C. All activity relating to the seizure, storage, examination, or transfer of the digital evidence must be recorded in writing and be available for review and testimony. D. In order to ensure that the digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement and forensic organizations must establish and maintain an effective quality system. E. Agency management must review the SOPs on an annual basis to ensure their continued suitability and effectiveness. F. The agency must use hardware and software that are appropriate and effective for the seizure or examination procedure. G. Any action that has potential to alter, damage, or destroy any aspect of the original evidence must be performed by qualified persons in a forensically sound manner. H. The agency must maintain written copies of appropriate technical procedures.

Answer 28

A. Standards and Criteria 1.3 B. Standards and Criteria 1.1 C. Standards and Criteria 1.6 D. Principle 1 E. Standards and Criteria 1.2 F. Standards and Criteria 1.5 G. Standards and Criteria 1.7 H. Standards and Criteria 1.4

Question 29

What does CIRT stand for?

Answer 29

Computer Incident Response Team

Question 30

What does SOC stand for?

Answer 30

Security Operations Center

Question 31

What is the SOC?

Answer 31

Security Operations Center (SOC) is a centralized unit that continuously monitors and analyzes ongoing activities on an organization's information systems such as networks, servers, endpoints, databases, applications, websites, etc. to look for anomalies

Question 32

In incident response, what is the role of the SOC?

Answer 32

The SOC team acts as the initial point for incident detection and validation

Question 33

Upon incident validation, the incident response team gathers the evidence and provides it to the _______ ______, which then starts the ______ investigation

Answer 33

forensics team Upon incident validation, the incident response team gathers the evidence and provides it to the forensics team which then starts the __________ investigation

Question 34

What are tracks on a hard drive?

Answer 34

concentric circles on platters

Question 35

How does track numbering begin on a hard drive?

Answer 35

from 0

Question 36

How much data does a sector hold on a hard drive?

Answer 36

512 bytes

Question 37

How is track density defined?

Answer 37

space between tracks on a disk

Question 38

How is areal density defined?

Answer 38

number of bits per square inch on a platter?

Question 39

How is bit density defined?

Answer 39

bits per unit length of track

Question 40

Formula of total size on a disk?

Answer 40

cylinders * heads * sectors * 512 bytes

Question 41

What is the smallest logical storage unit on a hard disk?

Answer 41

a cluster

Question 42

A _______ is a set of sectors with a disk ranging from ____ to _____

Answer 42

cluster 2 to 32

Question 43

clusters are also known as?

Answer 43

allocation units

Question 44

In the File Allocation Table (FAT) file system, the clusters linked with a file keep track of _____ _____ on the hard disk's file allocation

Answer 44

file data

Question 45

What is a File Allocation Table (FAT) error that occurs when the OS marks clusters as used but does not allocate any file to them called?

Answer 45

a lost cluster

Question 46

What are the two types of file slack?

Answer 46

Ram slack and drive slack

Question 47

In practice, the Master Boot Record (MBR) almost always refers to the _____ ______ boot sector (or partition sector) of a disk

Answer 47

512-byte

Question 48

What are the 3 main functions of the Master Boot Record?

Answer 48

--holding a partition table which refers to the partitions of a hard disk --bootstrapping an OS --distinctively recognizing individual hard disk media with a 32-bit signature

Question 49

Disk partitioning is the creation of _______ divisions on a storage device (HDD/SDD) to allow the user to OS-specific logical formatting

Answer 49

logical

Question 50

What is a Globally Unique Identifer (GUID)?

Answer 50

A GUID is a 128-bit number used to uniquely identify information in computer systems.

Question 51

What does Logon Event 4624 mean?

Answer 51

A user successfully logged on to a computer.

Question 52

What does Logon Type 2 mean?

Answer 52

Interactive A user logged on to this computer.

Question 53

What does Logon Type 3 mean?

Answer 53

Network A user or computer logged on to this computer from the network

Question 54

What does Logon Event 4625 mean?

Answer 54

Logon failure. A logon attempt was made with an unknown username or a known username with a bad password.