Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Host Based Forensics > Moral, Ethical and Legal Issues > Flashcards

Moral, Ethical and Legal Issues Flashcards

1
Q

What are the stages in the digital forensics process?

A

Recovery
Interpretation
Presentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In the digital forensics process, what happens in the recovery stage?

A

Data is extracted and then processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

During the recovery process, data is extracted. What may this involve?

A

Making a copy of a hard disk.
Downloading data from a mobile.
Recovering data from remote systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

During the recovery process, data is processed. What may this involve?

A

Decrypting data and recovering files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

During the recovery process, data is processed. Why do they do this?

A

To allow the examiner to work on them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In the digital forensics process, what happens in the interpretation stage?

A

Data is analysed and interpreted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

During the interpretation process, data is analysed. What may this involve?

A

Synthesising information from different sources. This requires expertise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In the digital forensics process, what happens in the presentation stage?

A

Findings are communicated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How are findings communicated?

A

Verbally to the investigation team.
As a written report.
Potential in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How are findings communicated?

A

Verbally to the investigation team.
As a written report.
Potential in court.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When can data be searched?

A

If the device has been lawfully seized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What law allows data to be searched if the device is lawfully seized?

A

Police and Criminal Evidence Act.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When may law enforcement intercept the content of communications?

A

With a warrant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What power allows law enforcement to intercept communications and acquire information about communications?

A

Regulation of investigatory Powers Act.
Data Retention and investigatory Powers Act.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What legislation allows investigators to acquire data with equipment and software.

A

Police and Crime Act.
Serious Crime Act.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which Act is important to ethical uses of computers?

A

Computer Misuse Act.

17
Q

What challenges could you face?

A

Encryption
Cloud Storage
Anti-forensics
Rapidly Changing Technology

18
Q

How does encryption pose a challenge to forensics investigations?

A

It scrambles data, so it can only be read by an authorised user.

19
Q

How does cloud storage pose a change to forensic investigations?

A

If deleted, it can be overwritten very quickly. This can make verification of the data difficult.
Data and activity records are less likely to be held locally on devices.
Lots of companies are based outside the UK.

20
Q

How do Law enforcement get data from companies based outside the UK?

A

They use Mutual Legal Assistance Treaties to get local law enforcement to issue a warrent to the company to abtain the data. This process can be extremely slow.

21
Q

What practice make up anti-forensics techniques?

A

Changing the dates and times associated with files to stop investigators building a reliable timeline of events.
Permanently erasing files by overwriting them.
Using encrypted digital storage with mulitple passwords leading to different sections of the drive. They can then revial data to a section with no crimial action while not revieling the hidden section.

22
Q

How does Rapidly Changing Technology pose a challenge to Forensic investiagtions?

A

New software and hardware must be studied to discover how to reliably find information of forensic value. This requires testing which often leaves forensic investigators playing catch up.

23
Q

What ways are there to address the challenges?

A

User encryption/cloud keys
Key Escrow/Backdoor

24
Q

How should the investigator act during forensic examinations?

A

They should maintain the greatest objectivity and present accurate findings.

25
Q

What are the ethical concerns in court?

A

All matters should be testified truthfully in court

26
Q

What shouldn’t an examiner do?

A

They shouldn’t take any action that would appear to be a conflict of interest.

27
Q

What are the ethical concerns of examinations?

A

Examinations must be based on well-extablished and validated principles.

28
Q

What is the examiner forbidden to do?

A

The examiner is forbidden to reveal any confidential information without the clients permission or a court order.

29
Q

What is the investigator not allowed to do?

A

Misrepresent credentials or associated memberships.

30
Q

What are the Good Practice steps?

A

▶ Document everything – photograph area
▶ If it is off do not turn on
▶ If on perform RAM forensics
▶ Document all drives removed
▶ Use write blocker to image
▶ Check BIOS clock with atomic clock
▶ During analysis all steps must be documented

Host Based Forensics (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions