Section 31: Incident Response and Forensics

Question 1

Legal Hold

Answer 1

A process designed to preserve all relevant information when litigation is reasonable expected to occur

Question 2

Timeline

Answer 2

A tool that shows the sequence of file system events within a source image in a graphical format

Question 3

Considerations in data collection

Answer 3

capture and has system images, analyze data with tools, capture screenshots, review network traffic and logs, capture video, consider order of volatility, etc.

Question 4

Data Acquisition

Answer 4

The method and tools used to create a forensically sound copy of data from a source device, such as system memory or a hard disk

Question 5

Order of volatility

Answer 5

cpu registers and cache memory

contents of system memory (RAM), routing tables, ARP cache, process table, temporary swap files

data on persistent mass storage (HDD/SSD/flash drive)

Remote logging and monitoring data

physical configuration and network topology

archival media (backup tapes, offsite storage, cds, dvds)

Question 5

Order of volatility

Answer 5

cpu registers and cache memory

contents of system memory (RAM), routing tables, ARP cache, process table, temporary swap files

data on persistent mass storage (HDD/SSD/flash drive)

Remote logging and monitoring data

physical configuration and network topology

archival media (backup tapes, offsite storage, cds, dvds)

Question 6

dd

Answer 6

A command line utility used to copy disk images using a bit by bit copying process

Question 7

FTK Imager

Answer 7

A data preview and imaging tool that lets you quickly assess electronic data

Question 8

Memdump

Answer 8

A command line utility used to dump system memory to the standard output steam by skipping over holes in memory maps

Question 9

WinHex

Answer 9

A commercial disk editor and universal hex editor used for data recovery and digital forensics

Question 10

Autopsy

Answer 10

A digital forensics platform and graphical interface to the The Sleuth Kit

Question 11

Metasploit (MSF)

Answer 11

A computer security tool that offers information about software vulnerabilities, IDS signature development, and improves penetration testing

Question 12

Browser Exploitation Framework (BeEF)

Answer 12

A tool that can hook one or more browsers and can use them as a beachhead

Question 13

Cain and Abel

Answer 13

password recovery used to sniff the network and crack passwords

Question 14

Jack the Ripper

Answer 14

an open source password security auditing and password recovery tool available