Module 3 Quiz

Question 1

Which forensics tools can connect to a suspect’s remote computer and run surreptitiously?

ddfldd and ProDiscover Incident Response

EnCase Enterprise and ProDiscover Incident Response

dd and ddfldd

dd and EnCase Enterprise

Answer 1

EnCase Enterprise and ProDiscover Incident Response

Question 2

What does a sparse acquisition collect for an investigation?

Only specific files of interest to the case

Fragments of unallocated data in addition to the logical allocated data

Only the logical allocated data

Only fragments of unallocated data

Answer 2

Fragments of unallocated data in addition to the logical allocated data

Question 3

Why is it a good practice to make two images of a suspect drive in a critical investigation?

To speed up the process

To have one compressed and one uncompressed copy

To ensure at least one good copy of the forensically collected data in case of any failures

None of the above

Answer 3

To ensure at least one good copy of the forensically collected data in case of any failures

Question 4

Slower data transfer speeds and dealing with minor data errors are two disadvantages of the raw format

True

False

Answer 4

False

Question 5

In Linux, the fdisk -l command lists the suspect drive as /dev/hda1. So, the following dcfldd is command correct. dcfldd if=image_file.img of=/dev/hda1

True

False

Answer 5

False

Question 6

What’s the maximum file size when writing data to a FAT32 drive?

2 GB

3 GB

4 GB

6 GB

Answer 6

2 GB

Question 7

What are two concerns when acquiring data from a RAID server?

Data transfer speeds and type of RAID

Type of RAID and antivirus software

Amount of data storage needed and type of RAID

Split RAID and Redundant RAID

Answer 7

Amount of data storage needed and type of RAID

Question 8

With remote acquisitions, what problems should you be aware of?

Data transfer speeds

Access permissions over the network

Antivirus, antispyware, and firewall programs

The password of the remote computer’s user

Answer 8

Antivirus, antispyware, and firewall programs

Question 9

What’s the most critical aspect of digital evidence?

Compression

Redundancy

Contingency

Validation

Answer 9

Validation

Question 10

A logical acquisition collects only specific files of interest to the case.

True

False

Answer 10

True

Question 11

FTK Imager requires that you use a device such as a USB dongle for licensing.

True

False

Answer 11

True

Question 12

With newer Linux kernel distributions, USB devices are automatically mounted, which can alter data on it.

True

False

Answer 12

True

Question 13

Name two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive.

dd and Expert Witness

dd and EnCase

X-Ways Forensics and dd

EnCase and X-Ways Forensics

Answer 13

EnCase and X-Ways Forensics

Question 14

FTK Imager can acquire data in a drive’s host protected area.

True

False

Answer 14

False

Question 15

Of all the proprietary formats, which one is the unofficial standard?

Expert Witness

AFF

Uncompress dd

Segmented dd

Answer 15

Expert Witness

Question 16

When determining which data acquisition method to use you should not consider how long the acquisition will take.

True

False

Answer 16

False

Question 17

A hashing algorithm is a program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk.

True

False

Answer 17

True

Question 18

Name the three formats for digital forensics data acquisitions.

Raw, AICIS, and AFF

EnCase format, Raw, and dd

Raw format, proprietary formats, and AFF

dd, Raw, and AFF

Answer 18

Raw format, proprietary formats, and AFF

Question 19

Commonly, proprietary format acquisition files can compress the acquisition data and segment acquisition output files into smaller volumes.

True

False

Answer 19

True

Question 20

The main goal of a static acquisition is the preservation of digital evidence.

True

False

Answer 20

True

Question 21

In the Linux dcfldd command, which three options are used for validating data?

hash, hashlog, and vf

h, hl, and vf

hash, log, and hashlog

vf, of, and vv

Answer 21

hash, hashlog, and vf