Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Forensic IT > Revision > Flashcards

Revision Flashcards

1
Q

Can you explain to someone what “ACPO” is?

A

ACPO Good Practice Guide For Digital Evidence v5 2012 – The “… guide is still widely regarded as the definitive best practice guide for computer forensics in the UK and elsewhere.” (7safe.com, 2015)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the main thing to remember about ACPO?

A

The principles;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Apart from the answer to b. above, what other useful things does ACPO cover?

A

The processes and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who uses ACPO?

A

Digital forensic professionals, Police, other countries…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Principle 1

A

no action taken by law enforcement agencies, persons employed with those agencies or their agents should change data which may subsequently be relied upon in court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

principle 2

A

in circumstances where a person finds it necessary to access data, that person must be competent to do so and give evidence explaining the relevance and implications of their actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

principle 3

A

an audit trail or other record of all processes applied to digital evidence should be created and preserved. an independent third party should be able to examine those processes and achieve the same result.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

principle 4

A

the person in charge of the investigation has overall responsibility that the law and these principles are adhered too.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

principles summarised

A
  1. don’t change any data
  2. if you have to access original data- you have to be able to explain exactly what effects your actions have had on the data
  3. chain of evidence- who had it, when, why, what
  4. the person in charge ensures the law and ACPO are followed to the letter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the Computer Misuse Act 1990?

A

UK Legislation, law, about ways you break the law if you use a computer to do certain things

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does ”unauthorised access” mean?

A

If you don’t have access to something and you get access to it in a way other than being given permission to have access to it, for example guessing a password, using an unlocked computer that is not for general use, using a file you have access to for an unauthorised purpose…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What might you have made if you are charged under section 3A?

A

Malware…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Section 3 and 3ZA both refer to what?

A

Intentionally breaking, hiding, preventing access to, or infecting a computer or system or causing damage or harm to a person or persons, economy by using a computer to cause that harm;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does GDPR stand for? What is GDPR?

A

General Data Protection Regulation. It is a European Regulation, which tells you how you MUST deal with data covered within the Regulation (the law), it differs from a European Directive which is more of a goal to acheive;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What or whom does GDPR affect?

A

The data of European Citizens;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who has to follow GDPR?

A

GDPR has to be followed by any one or any company any where in the world who collects and stores the data of a European Citizen;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does GDPR mean you have to do?

A

European Citizens data can only be collected for appropriate, specific purposes, processed according to and stored according to GDPR guidelines, kept for no longer than is necessary, notify the appropriate channels within 72 hours of a data breach occurring…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

If the UK leaves Europe, will we still need to follow GDPR? Why?

A

Yes, if anyone in the UK is collecting European Citizens data because it affects every country in the entire world if they collect data on European Citizens…

19
Q

What is the Data Protection Act 2018?

A

UK Legislation that dictates how peoples personal data is collected, stored, how long it is kept for, how it is processed…

20
Q

Why do we need to know about the Data Protection Act 2018 and GDPR?

A

Because the GDPR has been written into UK law as the 2018 Data Protection Act and GDPR will still need to be followed if the UK leave the EU. Also, GDPR and therefore the DPA 2018, both are sensible and help keep all our data safe and allow us as data subjects more rights than we’ve previously had over our own data.

21
Q

How does the 2018 version differ from the previous 1998 version?

A

The 2018 DPA builds upon the 1998 act, things have moved on technology wise since 1998 so the act as been updated with that in mind. As mentioned in b. we as data subjects now have far more rights over our data, such as the right to be forgotten and the right to request the data a company hold on us – with out being charged for it.

22
Q

Why would we need to know about the Data Protection Act 2018 as forensics professionals?

A

We might need to know about the DPA 2018 for a couple of reasons, firstly we might be analysing a forensic image and find data that has been obtained unlawfully – if we don’t know the DPA 2018, how can we know that. We keep hold of peoples data in many formats throughout an investigation so we must know how to look after the data properly.

23
Q

what is ethics?

A

The philosophy of thinking about what is right & wrong

24
Q

Why do we need to know & think about Ethics?

A

As digital forensics professionals we need to be doing what is right so if we know what is and isn’t ethical then we can ensure we are acting appropriately at all times;

25
Q

Is there a set ethical standard?

A

There is no one set of ethical standards, but as we are working with digital devices we can use the ACM’s Code of Ethics to guide us. Other countries and specific companies might have more specific guidance or even less guidance than that so you would need to make sure you are following an educated moral compass – like how ACPO has been adopted or used as a basis of other countries digital forensics procedures.

26
Q

What sort of ethical issues could we come across as a digital forensic professional?

A

Knowing information about people that we could use against them but knowing about right & wrong, we know that we have come across that information as part of an investigation as morally it would be wrong of us to do anything with that information - unless the information was the person breaking the law, in which case we wouldn’t “use it against them” but we would report it to the relevant authorities.

27
Q

What is incident response?

A

Incident response is about how you deal with an event, this could be at a crime scene or within a company network/online, but it is how you deal with the artefacts connected to the event, the process of dealing with it (steps/stages), and ensuring you follow procedures and guidelines.

28
Q

How many stages are there to incident response?

A

6 in total but stage 6 feeds into stage 1 so they could merge and make it 5 steps: Plan, Respond, Acquire, Analyse, Report, Learn. It’s a circular evolving process;

29
Q

What should you do as one of the very first tasks at a crime scene?

A

Take photographs, but also: sketch the scene, make notes, look around you, look at what is there, the details, as questions, never assume…

30
Q

What might you need to do with a computer at a crime scene?

A

Take it apart, collect the hard drive to take back to the lab, look for other artefacts hidden inside it, forensically image it at the crime scene, leave it switched on and take photos of the desktop and take a RAM dump, then image it or cut the power… it depends!

31
Q

what is a graphics card

A

A graphics card puts the picture on the screen;

32
Q

what does CPU stand for

A

Central Processing Unit;

33
Q

What does a stick of RAM do?

A

Acts as the computers short term memory;

34
Q

what is the difference between HDD and SDD

A

A HDD is a mechanical disk drive that has “platters” on which the data is written to and read from. A SSD is a non-mechanical drive that uses integrated circuitry to store data persistently (continuously).

35
Q

what is an operating system

A

An operating system is the software a computer uses to manage the hardware and other software resources installed within it.

36
Q

What are the 3 main operating systems we have spoken about?

A

Windows, Linux, Mac;

37
Q

What are FAT, NTFS, HFS, APFS examples of?

A

Filing systems;

1st 2 windows second 2 Mac

38
Q

What do each of the acronyms in c. stand for?

A

FAT: File Allocation Table; NTFS: New Technology File System; HFS: Hierarchical File System; APFS: Apple File System;

39
Q

ways to hide files

A

Setting a files properties (on the right click menu) to hidden;

Changing the file type extension – e.g. from .docx to .jpg or .txt;

Adding a password to the file;

Storing the file somewhere other than the “normal” storage areas, e.g. the Rubbish Bin, a system folder, on an external drive;

40
Q

What is a database?

A

A collection of entities (things/items) and the attributes that make up each entity;

41
Q

Why would you use one?

A

You might use one to compare a sample from a crime scene to a previous crime scene, to speed up the search process, to narrow down your search;

42
Q

how do they work

A

They might use a search term you type in and they look for that search term in the records they hold, or they might need to to select options from drop down menus…

43
Q

What database would you use if you were looking for:
Fingerprints;
A Car;
A child;

A

You would use: i. IDENT1; ii. NPC; iii. CAID

Forensic IT (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions