Overview Flashcards
What is digital forensics?
The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations [1].( Digital Forensics Research Workshop (DFRWS) in 2001)
What is data recovery?
involves recovering information from a computer that was deleted by mistake or lost during a power surge or server crash, for example. In data recovery, typically you know what you’re looking for.
What is slack space?
(or file slack): Unused space on a cluster that exists when the
logical file space is less than the physical file space. May hold the content of
files that previously occupied this space.
What is ASCII?
American Standard Code for Information Interchange. a character-encoding scheme originally based on the English alphabet. ASCII codes represent text in computers, communications equipment, and other devices that use text. Most modern character-encoding schemes are based on ASCII, though they support many additional characters.
ASCII includes definitions for 128 characters: 33 are non-printing control characters (many now obsolete)that affect how text and space are processedand 95 printable characters, including the space.
What is UNICODE?
Unicode is a computing industry standard for the consistent encoding, representation and handling of text expressed in most of the world’s writing systems. Unicode can be implemented by different character encodings. The most commonly used encodings are UTF-8, UTF-16 and the now-obsolete UCS-2. UTF-8 uses one byte for any ASCII characters, which have the same code values in both UTF-8 and ASCII encoding, and up to four bytes for other characters. UTF-16 uses two 16-bit units (4 × 8 bit) to handle each of the additional characters.
What is a sector?
A sector is a contiguous group of bytes within a track and is the smallest number of bytes that can be addressed or written to on a drive. Although it can vary, the number of bytes per sector is nearly always 512. By contrast, a CD-ROM will have 2,048 bytes per sector.
What is a cluster?
A group of sectors on a hard drive that represents the smallest
amount of data that can be allocated in a file system. Because sectors are
at the hardware level and clusters are at the operating system level, techies
often refer to sectors as physical address space and to clusters as logical
address space.
What is CHS?
Cylinder-head-sector, also known as CHS, was an early method for giving addresses to each physical block of data on a hard disk drive
What is a partition?
A partition is a collection of consecutive sectors within a volume, and those sectors are addressable by a single file system specific to and contained within that partition.
What is a volume?
A volume, by subtle contrast, is a collection of addressable sectors that are used by an operating
system or an application to store data. The addressable sectors in a volume do not have to be consecutive—
and therein lies the difference. Rather, they need only give the appearance of being
consecutive. When a volume consists of a single partition, the two are functionally the same. When
a volume spans more than one partition or drive, the difference becomes self-evident.
What is SCSI?
Small Computer Systems Interface -
an electronic interface that originated
with Apple Computer systems and migrated over to other systems. It is a high-speed, high-performance
interface, used on devices requiring high input/output such as scanners, hard
drives, and so forth.
What is USB?
Universal Serial Bus (USB) is an industry standard developed in the mid-1990s that defines the cables, connectors and communications protocols used in a bus for connection, communication and power supply between computers and electronic devices.
USB 1 - 1.5 - 12 Mbit/s
USB 2 - 480 Mbit/s
USB 3 - 5 Gbits/s
What is Chain of Custod?
The chain of custody requires that from the moment the evidence is collected, every transfer of evidence from person to person be documented and that it be provable that nobody else could have accessed that evidence. It is best to keep the number of transfers as low as possible.
What is CDMA?
Code division multiple access (CDMA) is a channel access method used by various radio communication technologies.
What is CRC?
A cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data. Blocks of data entering these systems get a short check value attached
What is drive slack?
Same as file slack or a subset of File slack - What about the remaining sectors which are a part of the last cluster assigned to the file but not filled with any file data. The OS doesnt take further pains like it did with the last sector to be written with file data. Instead it doesnt write anything to the remaining sectors of the cluster. The result? Whatever was stored on that area of the disk remains there and could contain remnants of previously deleted files or the pattern which should be there if the disk is fresh and being used for the first time or even the data which existed before the last format!
What is EFS?
The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS that provides filesystem-level encryption. The technology enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer.
EFS is available in all versions of Windows developed for business environments from Windows 2000 onwards. By default, no files are encrypted, but encryption can be enabled by users on a per-file, per-directory, or per-drive basis. Some EFS settings can also be mandated via Group Policy in Windows domain environments.
What is EDGE?
Enhanced Data rates for GSM Evolution (EDGE). A digital mobile phone technology that allows improved data transmission rates as a backward-compatible extension of GSM. EDGE is considered a pre-3G radio technology.
Through the introduction of sophisticated methods of coding and transmitting data, EDGE delivers higher bit-rates per radio channel, resulting in a threefold increase in capacity and performance compared with an ordinary GSM/GPRS connection
What is SMTP?
Simple Mail Transfer Protocol (SMTP) is an Internet standard for electronic mail (e-mail) transmission across Internet Protocol (IP) networks. Port 25.
While electronic mail servers and other mail transfer agents use SMTP to send and receive mail messages, user-level client mail applications typically use SMTP only for sending messages to a mail server for relaying. For receiving messages, client applications usually use either the Post Office Protocol (POP) or the Internet Message Access Protocol (IMAP) or a proprietary system (such as Microsoft Exchange or Lotus Notes/Domino) to access their mail box accounts on a mail server.
What is EXIF?
Exchangeable image file format (Exif) is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.
The metadata tags defined in the Exif standard cover a broad spectrum:
- Date and time information.
- Camera settings.
- A thumbnail for previewing the picture
- Descriptions
- Copyright information.
What is disk geometry?
Description of physical layout of hard disk drive in terms of cylinder, heads and sectors.
What is LBA?
Logical block addressing (LBA) is a common scheme used for specifying the location of blocks of data stored on computer storage devices, generally secondary storage systems such as hard disks.
LBA is a particularly simple linear addressing scheme; blocks are located by an integer index, with the first block being LBA 0, the second LBA 1, and so on.
The LBA scheme replaces earlier schemes which exposed the physical details of the storage device to the software of the operating system. Chief among these was the cylinder-head-sector (CHS) scheme, where blocks were addressed by means of a tuple which defined the cylinder, head, and sector at which they appeared on the hard disk.
What is the info2 file?
Windows XP automatically keep an index of what was deleted and when. It is kept in the Recycle Bin and and it containes entries, identified by index number, which described the original files size, full path/name, and size.
What are inodes?
an inode (index node) is a data structure found in many Unix file systems. Each inode stores all the information about a file system object (file, device node, socket, pipe, etc.), except data content and file name. eg. file ownership, access mode (read, write, execute permissions), and file type.
What is KFF?
Known File Filter, or KFF, can be used to eliminate or highlight known files using MD5 hashes generated by user or by a publisher such as NIST or Hashkeeper.
What is the MBR?
Master Boot Record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives.
The MBR holds the information on how the logical partitions, containing file systems, are organized on that mediumw
What is the MFT?
In NTFS, all file, directory and metafile data —file name, creation date, access permissions (by the use of access control lists), and size— are stored as metadata in the Master File Table
What is mbox?
mbox is a generic term for a family of related file formats used for holding collections of electronic mail messages. All messages in an mbox mailbox are concatenated and stored as plain text in a single file. The beginning of each message is indicated by a line whose first five characters consist of “From” followed by a space (the so named “From_ line” or “‘From ‘ line” or simply “From line”) and the sender’s e-mail address. A blank line is appended to the end of each message. For a while, the mbox format was popular because text processing tools can be readily used on the plain text files used to store the e-mail messages.
What is MD5?
The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value
What is a hash?
A cryptographic hash function is a hash function; that is, an algorithm that takes an arbitrary block of data and returns a fixed-size bit string, the (cryptographic) hash value, such that any (accidental or intentional) change to the data will (with very high probability) change the hash value.
